Modifies WindowProxy::setSecurityToken so that the frame's SecurityOrigin is taken into account whe…

Source/bindings/core/v8/ScriptController.cpp

Index: Source/bindings/core/v8/ScriptController.cpp
diff --git a/Source/bindings/core/v8/ScriptController.cpp b/Source/bindings/core/v8/ScriptController.cpp
index 94a454008a6a30c2328eb8faa2fa5bb6bb492702..9e902e9d37190395b202756913a01ae202ded61a 100644
--- a/Source/bindings/core/v8/ScriptController.cpp
+++ b/Source/bindings/core/v8/ScriptController.cpp
@@ -141,6 +141,13 @@ void ScriptController::clearForClose()
 void ScriptController::updateSecurityOrigin(SecurityOrigin* origin)
 {
     m_windowProxyManager->mainWorldProxy()->updateSecurityOrigin(origin);
+    Vector<std::pair<ScriptState*, SecurityOrigin*>> isolatedContexts;
+    m_windowProxyManager->collectIsolatedContexts(isolatedContexts);
+    for (auto isolatedContext : isolatedContexts) {
+        WindowProxy* proxy = m_windowProxyManager->existingWindowProxy(isolatedContext.first->world());

[haraken, 2015/09/14 15:28:59]

I think we should call windowProxy, not existingWindowProxy.

Note that existingWindowProxy is for devtools only (see the comment on
WindowProxyManager::existingWindowProxy).

[epertoso, 2015/09/14 15:59:37]

But windowProxy() will create a proxy if there isn't one already. Do we want
this?

[haraken, 2015/09/14 23:46:04]

I can't come up with a scenario where the isolated world doesn't have a
WindowProxy when we reach here.

Even if it happens, a right thing would be to create a WindowProxy and set a
security origin on it. Otherwise, the WindowProxy will be instantiated without
setting the security origin, which seems wrong.

So, calling windowProxy() would be a right thing here, I think.

[epertoso, 2015/09/15 08:24:58]

Done.

+        if (proxy)
+            proxy->setSecurityToken(isolatedContext.second);

[haraken, 2015/09/14 15:28:59]

How about calling updateSecurityOrigin, just like we do for the main world proxy
at line 143?

[epertoso, 2015/09/14 15:59:37]

updateSecurityOrigin has an ASSERT that implies it's expected to be called only
for the main world.

We could remove the assert, if you prefer.

[haraken, 2015/09/14 23:46:04]

I think it does make sense to remove the assert now, since we're adding the
security origin to isolated worlds in this CL.

[epertoso, 2015/09/15 08:24:58]

Done.

+    }
 }
 
 v8::MaybeLocal<v8::Value> ScriptController::callFunction(v8::Local<v8::Function> function, v8::Local<v8::Value> receiver, int argc, v8::Local<v8::Value> info[])