Index: third_party/WebKit/Source/core/loader/NavigationScheduler.cpp |
diff --git a/third_party/WebKit/Source/core/loader/NavigationScheduler.cpp b/third_party/WebKit/Source/core/loader/NavigationScheduler.cpp |
index f4a962da8b6d02ed5ec02d25a7aef5612297a456..3edce4571bec3615f942c9cff57bf8c19f895ecc 100644 |
--- a/third_party/WebKit/Source/core/loader/NavigationScheduler.cpp |
+++ b/third_party/WebKit/Source/core/loader/NavigationScheduler.cpp |
@@ -108,14 +108,22 @@ protected: |
: ScheduledNavigation(delay, originDocument, replacesCurrentItem, isLocationChange) |
, m_url(url) |
, m_shouldCheckMainWorldContentSecurityPolicy(CheckContentSecurityPolicy) |
+ , m_originWorld(nullptr) |
{ |
if (ContentSecurityPolicy::shouldBypassMainWorld(originDocument)) |
m_shouldCheckMainWorldContentSecurityPolicy = DoNotCheckContentSecurityPolicy; |
+ |
+ // Store the world id of the frame requesting the navigation in case it's a 'javascript:...' url. |
+ if (v8::Isolate::GetCurrent()->InContext()) { |
+ m_originWorld = PassRefPtr<DOMWrapperWorld>(DOMWrapperWorld::current(v8::Isolate::GetCurrent()).originWorld()); |
+ } |
} |
void fire(LocalFrame* frame) override |
{ |
OwnPtr<UserGestureIndicator> gestureIndicator = createUserGestureIndicator(); |
+ // Ensure the origin world gets propagated to the navigation and is reset afterwards. |
+ DOMWrapperWorld::OriginWorldScope worldScope(m_originWorld); |
FrameLoadRequest request(originDocument(), m_url, "_self", m_shouldCheckMainWorldContentSecurityPolicy); |
request.setReplacesCurrentItem(replacesCurrentItem()); |
request.setClientRedirect(ClientRedirect); |
@@ -126,6 +134,7 @@ protected: |
private: |
String m_url; |
+ RefPtr<DOMWrapperWorld> m_originWorld; |
ContentSecurityPolicyDisposition m_shouldCheckMainWorldContentSecurityPolicy; |
}; |