Modifies WindowProxy::setSecurityToken so that the frame's SecurityOrigin is taken into account whe…

Source/bindings/core/v8/WindowProxy.cpp

 /*
  * Copyright (C) 2008, 2009, 2011 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 436 matching lines @@
     // origins that should only allow access to themselves. In this
     // case, we use the global object as the security token to avoid
     // calling canAccess when a script accesses its own objects.
     v8::HandleScope handleScope(m_isolate);
     v8::Local<v8::Context> context = m_scriptState->context();
     if (token.isEmpty() || token == "null") {
         context->UseDefaultSecurityToken();
         return;
     }
 
-    if (m_world->isPrivateScriptIsolatedWorld())
+    if (m_world->isPrivateScriptIsolatedWorld()) {
         token = "private-script://" + token;
+    } else if (m_world->isIsolatedWorld()) {
+        SecurityOrigin* frameSecurityOrigin = m_frame->securityContext()->securityOrigin();
+        String frameSecurityToken = frameSecurityOrigin->toString();
+        // We need to check the return value of domainWasSetInDOM() on the
+        // frame's SecurityOrigin because, if that's the case, only
+        // SecurityOrigin::m_domain would have been modified.
+        // m_domain is not used by SecurityOrigin::toString(), so we would end
+        // up generating the same token that was already set.
+        if (frameSecurityOrigin->domainWasSetInDOM() || frameSecurityToken.isEmpty() || frameSecurityToken == "null") {
+            context->UseDefaultSecurityToken();
+            return;
+        }
+        token = frameSecurityToken + token;
+    }
 
     CString utf8Token = token.utf8();
     // NOTE: V8 does identity comparison in fast path, must use a symbol
     // as the security token.
     context->SetSecurityToken(v8AtomicString(m_isolate, utf8Token.data(), utf8Token.length()));
 }
 
 void WindowProxy::updateDocument()
 {
     ASSERT(m_world->isMainWorld());
@@ skipping 72 matching lines @@
 
     ScriptState::Scope scope(m_scriptState.get());
     ASSERT(!m_document.isEmpty());
     v8::Local<v8::Object> documentHandle = m_document.newLocal(m_isolate);
     checkDocumentWrapper(documentHandle, document);
     documentHandle->Delete(m_isolate->GetCurrentContext(), v8String(m_isolate, name));
 }
 
 void WindowProxy::updateSecurityOrigin(SecurityOrigin* origin)
 {
-    ASSERT(m_world->isMainWorld());
     if (!isContextInitialized())
         return;
     setSecurityToken(origin);
 }
 
 } // namespace blink