Add access checks to V8WrapperInstationScope.

Source/bindings/core/v8/V8DOMWrapper.cpp

Index: Source/bindings/core/v8/V8DOMWrapper.cpp
diff --git a/Source/bindings/core/v8/V8DOMWrapper.cpp b/Source/bindings/core/v8/V8DOMWrapper.cpp
index d1d463530fce504e16c7315e5d844489bfd81409..feedad6cec93ab07a5f39de2a73c13c5aae1168b 100644
--- a/Source/bindings/core/v8/V8DOMWrapper.cpp
+++ b/Source/bindings/core/v8/V8DOMWrapper.cpp
@@ -34,6 +34,7 @@
 #include "bindings/core/v8/V8Binding.h"
 #include "bindings/core/v8/V8HTMLCollection.h"
 #include "bindings/core/v8/V8HTMLDocument.h"
+#include "bindings/core/v8/V8Location.h"
 #include "bindings/core/v8/V8ObjectConstructor.h"
 #include "bindings/core/v8/V8PerContextData.h"
 #include "bindings/core/v8/V8PerIsolateData.h"
@@ -72,7 +73,12 @@ static v8::Local<v8::Object> wrapInShadowTemplate(v8::Local<v8::Object> wrapper,
 
 v8::Local<v8::Object> V8DOMWrapper::createWrapper(v8::Isolate* isolate, v8::Local<v8::Object> creationContext, const WrapperTypeInfo* type, ScriptWrappable* scriptWrappable)
 {
-    V8WrapperInstantiationScope scope(creationContext, isolate);
+    ASSERT(!type->equals(&V8Window::wrapperTypeInfo));
+    // According to https://html.spec.whatwg.org/multipage/browsers.html#security-location,
+    // cross-origin script access to a few properties of Location is allowed.
+    // Location already implements the necessary security checks.
+    bool withSecurityCheck = !type->equals(&V8Location::wrapperTypeInfo);
+    V8WrapperInstantiationScope scope(creationContext, isolate, withSecurityCheck);
 
     V8PerContextData* perContextData = V8PerContextData::from(scope.context());
     v8::Local<v8::Object> wrapper;
@@ -124,4 +130,14 @@ bool V8DOMWrapper::hasInternalFieldsSet(v8::Local<v8::Value> value)
         && untrustedWrapperTypeInfo->ginEmbedder == gin::kEmbedderBlink;
 }
 
+void V8WrapperInstantiationScope::SecurityCheck(v8::Isolate* isolate, v8::Local<v8::Context> contextForWrapper)
+{
+    if (!m_context.IsEmpty()) {
+        // If the context is different, we need to make sure that the current
+        // context has access to the creation context.
+        Frame* frame = toFrameIfNotDetached(contextForWrapper);
+        RELEASE_ASSERT(!frame || BindingSecurity::shouldAllowAccessToFrame(isolate, frame, DoNotReportSecurityError));
+    }
+}
+
 } // namespace blink