Fix security checks when navigating remote frames to javascript: URLs.

third_party/WebKit/Source/bindings/core/v8/ScriptController.cpp

 /*
  * Copyright (C) 2008, 2009 Google Inc. All rights reserved.
  * Copyright (C) 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2014 Opera Software ASA. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
@@ skipping 65 matching lines @@
 #include "public/platform/Platform.h"
 #include "wtf/CurrentTime.h"
 #include "wtf/StdLibExtras.h"
 #include "wtf/StringExtras.h"
 #include "wtf/text/CString.h"
 #include "wtf/text/StringBuilder.h"
 #include "wtf/text/TextPosition.h"
 
 namespace blink {
 
-bool ScriptController::canAccessFromCurrentOrigin(LocalFrame *frame)
+bool ScriptController::canAccessFromCurrentOrigin(ExecutionContext& context, Frame* frame)

[haraken, 2016/02/23 10:07:59]

How about just passing v8::Isolate, rather than ExecutionContext?

[alexmos, 2016/02/23 17:51:05]

Done.

 {
     if (!frame)
         return false;
-    v8::Isolate* isolate = toIsolate(frame);
+    v8::Isolate* isolate = toIsolate(&context);
     return !isolate->InContext() || BindingSecurity::shouldAllowAccessToFrame(isolate, callingDOMWindow(isolate), frame, ReportSecurityError);
 }
 
 ScriptController::ScriptController(LocalFrame* frame)
     : m_windowProxyManager(WindowProxyManager::create(*frame))
     , m_sourceURL(0)
     , m_windowScriptNPObject(0)
 {
 }
 
@@ skipping 496 matching lines @@
         for (size_t i = 0; i < resultArray->Length(); ++i) {
             v8::Local<v8::Value> value;
             if (!resultArray->Get(scriptState->context(), i).ToLocal(&value))
                 return;
             results->append(value);
         }
     }
 }
 
 } // namespace blink