Plumb the correct owner document through DocumentInit::m_owner.

third_party/WebKit/Source/core/dom/SecurityContext.cpp

Index: third_party/WebKit/Source/core/dom/SecurityContext.cpp
diff --git a/third_party/WebKit/Source/core/dom/SecurityContext.cpp b/third_party/WebKit/Source/core/dom/SecurityContext.cpp
index a37ff6b8230baa1b56ff5bf886d6a06243d97da4..015f65d537f54a9f45b03fc6b4b432082043e61b 100644
--- a/third_party/WebKit/Source/core/dom/SecurityContext.cpp
+++ b/third_party/WebKit/Source/core/dom/SecurityContext.cpp
@@ -32,8 +32,7 @@
 namespace blink {
 
 SecurityContext::SecurityContext()
-    : m_haveInitializedSecurityOrigin(false)
-    , m_sandboxFlags(SandboxNone)
+    : m_sandboxFlags(SandboxNone)
     , m_hostedInReservedIPRange(false)
     , m_insecureRequestsPolicy(InsecureRequestsDoNotUpgrade)
     , m_enforceStrictMixedContentChecking(false)
@@ -52,7 +51,6 @@ DEFINE_TRACE(SecurityContext)
 void SecurityContext::setSecurityOrigin(PassRefPtr<SecurityOrigin> securityOrigin)
 {
     m_securityOrigin = securityOrigin;
-    m_haveInitializedSecurityOrigin = true;
 }
 
 void SecurityContext::setContentSecurityPolicy(PassRefPtrWillBeRawPtr<ContentSecurityPolicy> contentSecurityPolicy)
@@ -60,18 +58,6 @@ void SecurityContext::setContentSecurityPolicy(PassRefPtrWillBeRawPtr<ContentSec
     m_contentSecurityPolicy = contentSecurityPolicy;
 }
 
-bool SecurityContext::isSecureTransitionTo(const KURL& url) const
-{
-    // If we haven't initialized our security origin by now, this is probably
-    // a new window created via the API (i.e., that lacks an origin and lacks
-    // a place to inherit the origin from).
-    if (!haveInitializedSecurityOrigin())
-        return true;

[dcheng, 2016/02/24 21:59:02]

There are at least two scenarios to consider here:

1) Creating a new top-level page with something like noopener, which prevents
inheriting the security origin. In that case, the LocalDOMWindow object has a
unique origin. No other frame could have injected properties/event listeners
into it, so it's OK to just use a new Window object. From an efficiency
standpoint, it's probably more efficient to reuse the Window object, but from a
perspective of understanding the code, I think it's nice to remove this edge
case.

2) Unfortunately, this doesn't interact well with page popups. Page popups
currently a LocalDOMWindow supplement: without this logic, the LocalDOMWindow
changes after the supplement is installed. Then we crash inside v8 bindings when
the page popup tries to access its bindings. To fix this, I've changed the page
popup supplement to be bound to a frame.

-
-    RefPtr<SecurityOrigin> other = SecurityOrigin::create(url);
-    return securityOrigin()->canAccess(other.get());
-}
-
 void SecurityContext::enforceSandboxFlags(SandboxFlags mask)
 {
     m_sandboxFlags |= mask;