PaymentRequest should throw if not in top context.

third_party/WebKit/Source/modules/payments/PaymentRequest.cpp

 // Copyright 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "modules/payments/PaymentRequest.h"
 
 #include "bindings/core/v8/ExceptionState.h"
 #include "bindings/core/v8/JSONValuesForV8.h"
 #include "bindings/core/v8/ScriptPromiseResolver.h"
 #include "bindings/core/v8/ScriptState.h"
@@ skipping 283 matching lines @@
     EventTargetWithInlineData::trace(visitor);
     ContextLifecycleObserver::trace(visitor);
 }
 
 PaymentRequest::PaymentRequest(ScriptState* scriptState, const Vector<String>& supportedMethods, const PaymentDetails& details, const PaymentOptions& options, const ScriptValue& data, ExceptionState& exceptionState)
     : ContextLifecycleObserver(scriptState->getExecutionContext())
     , ActiveScriptWrappable(this)
     , m_options(options)
     , m_clientBinding(this)
 {
-    // TODO(rouslan): Also check for a top-level browsing context.
-    // https://github.com/w3c/browser-payment-api/issues/2
     if (!scriptState->getExecutionContext()->isSecureContext()) {
         exceptionState.throwSecurityError("Must be in a secure context");
         return;
     }
 
+    if (!scriptState->domWindow()->frame() || !scriptState->domWindow()->frame()->isMainFrame()) {
+        exceptionState.throwSecurityError("Must be in a top-level browsing context");
+        return;
+    }
+
     if (supportedMethods.isEmpty()) {
         exceptionState.throwTypeError("Must specify at least one payment method identifier");
         return;
     }
     m_supportedMethods = supportedMethods;
 
     validatePaymentDetails(details, exceptionState);
     if (exceptionState.hadException())
         return;
     m_details = details;
@@ skipping 119 matching lines @@
 void PaymentRequest::clearResolversAndCloseMojoConnection()
 {
     m_completeResolver.clear();
     m_showResolver.clear();
     if (m_clientBinding.is_bound())
         m_clientBinding.Close();
     m_paymentProvider.reset();
 }
 
 } // namespace blink