| Index: src/isolate.cc
|
| diff --git a/src/isolate.cc b/src/isolate.cc
|
| index ed44793e0714d31056049310e7e47a334ab95fbe..b2bcd9ecd01cc5d59468d7c891862b1ccbbc40bb 100644
|
| --- a/src/isolate.cc
|
| +++ b/src/isolate.cc
|
| @@ -774,7 +774,8 @@ bool Isolate::IsInternallyUsedPropertyName(Handle<Object> name) {
|
|
|
| bool Isolate::MayAccess(Handle<Context> accessing_context,
|
| Handle<JSObject> receiver) {
|
| - DCHECK(receiver->IsJSGlobalProxy() || receiver->IsAccessCheckNeeded());
|
| + DCHECK(receiver->IsJSGlobalProxy() || receiver->IsJSGlobalObject() ||
|
| + receiver->IsAccessCheckNeeded());
|
|
|
| // Check for compatibility between the security tokens in the
|
| // current lexical context and the accessed object.
|
| @@ -801,6 +802,28 @@ bool Isolate::MayAccess(Handle<Context> accessing_context,
|
| }
|
| }
|
|
|
| + {
|
| + DisallowHeapAllocation no_gc;
|
| + // During bootstrapping, callback functions are not enabled yet.
|
| + if (bootstrapper()->IsActive()) return true;
|
| +
|
| + if (receiver->IsJSGlobalObject()) {
|
| + Object* receiver_context =
|
| + JSGlobalObject::cast(*receiver)->native_context();
|
| + if (!receiver_context->IsContext()) return false;
|
| +
|
| + // Get the native context of current top context.
|
| + // avoid using Isolate::native_context() because it uses Handle.
|
| + Context* native_context =
|
| + accessing_context->global_object()->native_context();
|
| + if (receiver_context == native_context) return true;
|
| +
|
| + if (Context::cast(receiver_context)->security_token() ==
|
| + native_context->security_token())
|
| + return true;
|
| + }
|
| + }
|
| +
|
| HandleScope scope(this);
|
| Handle<Object> data;
|
| v8::AccessCheckCallback callback = nullptr;
|
|
|