Index: src/isolate.cc |
diff --git a/src/isolate.cc b/src/isolate.cc |
index ed44793e0714d31056049310e7e47a334ab95fbe..b2bcd9ecd01cc5d59468d7c891862b1ccbbc40bb 100644 |
--- a/src/isolate.cc |
+++ b/src/isolate.cc |
@@ -774,7 +774,8 @@ bool Isolate::IsInternallyUsedPropertyName(Handle<Object> name) { |
bool Isolate::MayAccess(Handle<Context> accessing_context, |
Handle<JSObject> receiver) { |
- DCHECK(receiver->IsJSGlobalProxy() || receiver->IsAccessCheckNeeded()); |
+ DCHECK(receiver->IsJSGlobalProxy() || receiver->IsJSGlobalObject() || |
+ receiver->IsAccessCheckNeeded()); |
// Check for compatibility between the security tokens in the |
// current lexical context and the accessed object. |
@@ -801,6 +802,28 @@ bool Isolate::MayAccess(Handle<Context> accessing_context, |
} |
} |
+ { |
+ DisallowHeapAllocation no_gc; |
+ // During bootstrapping, callback functions are not enabled yet. |
+ if (bootstrapper()->IsActive()) return true; |
+ |
+ if (receiver->IsJSGlobalObject()) { |
+ Object* receiver_context = |
+ JSGlobalObject::cast(*receiver)->native_context(); |
+ if (!receiver_context->IsContext()) return false; |
+ |
+ // Get the native context of current top context. |
+ // avoid using Isolate::native_context() because it uses Handle. |
+ Context* native_context = |
+ accessing_context->global_object()->native_context(); |
+ if (receiver_context == native_context) return true; |
+ |
+ if (Context::cast(receiver_context)->security_token() == |
+ native_context->security_token()) |
+ return true; |
+ } |
+ } |
+ |
HandleScope scope(this); |
Handle<Object> data; |
v8::AccessCheckCallback callback = nullptr; |