Make sure binding security checks don't pass if the frame is remote.

third_party/WebKit/Source/core/frame/DOMWindow.cpp

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "core/frame/DOMWindow.h"
 
 #include "bindings/core/v8/ScriptCallStack.h"
 #include "core/dom/Document.h"
 #include "core/dom/ExceptionCode.h"
 #include "core/dom/ExecutionContext.h"
@@ skipping 241 matching lines @@
     if (!callingWindow || !callingWindow->document() || !frame())
         return String();
 
     const KURL& callingWindowURL = callingWindow->document()->url();
     if (callingWindowURL.isNull())
         return String();
 
     // FIXME: This message, and other console messages, have extra newlines. Should remove them.
     const SecurityOrigin* activeOrigin = callingWindow->document()->securityOrigin();
     const SecurityOrigin* targetOrigin = frame()->securityContext()->securityOrigin();
-    ASSERT(!activeOrigin->canAccessCheckSuborigins(targetOrigin));
+    // It's possible for a remote frame to be same origin with respect to a
+    // local frame, but it must still be treated as a disallowed cross-domain
+    // access. See https://crbug.com/601629.
+    ASSERT(frame()->isRemoteFrame() || !activeOrigin->canAccessCheckSuborigins(targetOrigin));
 
     String message = "Blocked a frame with origin \"" + activeOrigin->toString() + "\" from accessing a frame with origin \"" + targetOrigin->toString() + "\". ";
 
     // Sandbox errors: Use the origin of the frames' location, rather than their actual origin (since we know that at least one will be "null").
     KURL activeURL = callingWindow->document()->url();
     // TODO(alexmos): RemoteFrames do not have a document, and their URLs
     // aren't replicated.  For now, construct the URL using the replicated
     // origin for RemoteFrames. If the target frame is remote and sandboxed,
     // there isn't anything else to show other than "null" for its origin.
     KURL targetURL = isLocalDOMWindow() ? document()->url() : KURL(KURL(), targetOrigin->toString());
@@ skipping 92 matching lines @@
     page->focusController().focusDocumentView(frame(), true /* notifyEmbedder */);
 }
 
 DEFINE_TRACE(DOMWindow)
 {
     visitor->trace(m_location);
     EventTargetWithInlineData::trace(visitor);
 }
 
 } // namespace blink