Deny cross-origin access to 'window.history'.

Source/core/page/History.idl

Index: Source/core/page/History.idl
diff --git a/Source/core/page/History.idl b/Source/core/page/History.idl
index 92d889a9ec24a9f7f2ec48aa091eee87f231e67c..40e6648da9be29fad1922e94f67a8e2f7feeb6a2 100644
--- a/Source/core/page/History.idl
+++ b/Source/core/page/History.idl
@@ -23,18 +23,13 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-[
-    CheckSecurity,
-    CustomNamedSetter,
-    CustomDeleteProperty,
-    CustomEnumerateProperty,

[abarth-chromium, 2013/05/06 16:51:00]

I would have expected that we'd need to delete these custom bindings, but I
couldn't find them anywhere.

-] interface History {
+interface History {
     readonly attribute unsigned long length;
     [CachedAttribute, Custom] readonly attribute SerializedScriptValue state;
 
-    [DoNotCheckSecurity, CallWith=ScriptExecutionContext] void back();
-    [DoNotCheckSecurity, CallWith=ScriptExecutionContext] void forward();
-    [DoNotCheckSecurity, CallWith=ScriptExecutionContext] void go([Default=Undefined] optional long distance);
+    [CallWith=ScriptExecutionContext] void back();
+    [CallWith=ScriptExecutionContext] void forward();
+    [CallWith=ScriptExecutionContext] void go([Default=Undefined] optional long distance);
 
     [Custom, EnabledPerContext=pushState, RaisesException] void pushState(any data, DOMString title, optional DOMString url);
     [Custom, EnabledPerContext=pushState, RaisesException] void replaceState(any data, DOMString title, optional DOMString url);