Transitively keep track of an isolated world's children scripts and worlds.

third_party/WebKit/Source/core/loader/NavigationScheduler.cpp

 /*
  * Copyright (C) 2006, 2007, 2008, 2009, 2010 Apple Inc. All rights reserved.
  * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
  * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  * Copyright (C) 2009 Adam Barth. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  *
@@ skipping 90 matching lines @@
     bool m_wasUserGesture;
     RefPtr<UserGestureToken> m_userGestureToken;
 };
 
 class ScheduledURLNavigation : public ScheduledNavigation {
 protected:
     ScheduledURLNavigation(double delay, Document* originDocument, const String& url, bool replacesCurrentItem, bool isLocationChange)
         : ScheduledNavigation(delay, originDocument, replacesCurrentItem, isLocationChange)
         , m_url(url)
         , m_shouldCheckMainWorldContentSecurityPolicy(CheckContentSecurityPolicy)
+        , m_originWorld(nullptr)
     {
         if (ContentSecurityPolicy::shouldBypassMainWorld(originDocument))
             m_shouldCheckMainWorldContentSecurityPolicy = DoNotCheckContentSecurityPolicy;
+
+        // Store the world id of the frame requesting the navigation in case it's a 'javascript:...' url.
+        if (v8::Isolate::GetCurrent()->InContext()) {
+            m_originWorld = PassRefPtr<DOMWrapperWorld>(DOMWrapperWorld::current(v8::Isolate::GetCurrent()).originWorld());
+        }
     }
 
     void fire(LocalFrame* frame) override
     {
         OwnPtr<UserGestureIndicator> gestureIndicator = createUserGestureIndicator();
+        // Ensure the origin world gets propagated to the navigation and is reset afterwards.
+        DOMWrapperWorld::OriginWorldScope worldScope(m_originWorld);
         FrameLoadRequest request(originDocument(), m_url, "_self", m_shouldCheckMainWorldContentSecurityPolicy);
         request.setReplacesCurrentItem(replacesCurrentItem());
         request.setClientRedirect(ClientRedirect);
         frame->loader().load(request);
     }
 
     String url() const { return m_url; }
 
 private:
     String m_url;
+    RefPtr<DOMWrapperWorld> m_originWorld;
     ContentSecurityPolicyDisposition m_shouldCheckMainWorldContentSecurityPolicy;
 };
 
 class ScheduledRedirect final : public ScheduledURLNavigation {
 public:
     static PassOwnPtrWillBeRawPtr<ScheduledRedirect> create(double delay, Document* originDocument, const String& url, bool replacesCurrentItem)
     {
         return adoptPtrWillBeNoop(new ScheduledRedirect(delay, originDocument, url, replacesCurrentItem));
     }
 
@@ skipping 292 matching lines @@
     m_redirect.clear();
 }
 
 DEFINE_TRACE(NavigationScheduler)
 {
     visitor->trace(m_frame);
     visitor->trace(m_redirect);
 }
 
 } // namespace blink