Pipe a script's CORS status through V8 during compilation.

include/v8.h

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 924 matching lines @@
 
 
 /**
  * The origin, within a file, of a script.
  */
 class ScriptOrigin {
  public:
   V8_INLINE(ScriptOrigin(
       Handle<Value> resource_name,
       Handle<Integer> resource_line_offset = Handle<Integer>(),
-      Handle<Integer> resource_column_offset = Handle<Integer>()))
+      Handle<Integer> resource_column_offset = Handle<Integer>(),
+      Handle<Boolean> resource_passed_access_check = Handle<Boolean>()))

[Michael Starzinger, 2013/07/30 09:52:55]

The term "access check" is already used in the API to describe something else.
The semantics of this boolean field are completely up to the embedder (i.e.
Chromium). Could I convince you to use a different term here? One suggestion
would be "embedder check", but I am open towards alternatives.

[Mike West, 2013/07/30 10:01:58]

The goal is to allow the embedder to determine whether or not an exception
(Message) has been thrown from a Script that was loaded in such a way as to
allow exception details to be visible. In practice, this means that the script
was loaded with an 'Access-Control-Allow-Origin' header.

You're correct to say that this is embedder-specific. I'm not sure that node
would care, for instance.

I'd prefer something more specific than "embedder check", as it's entirely
possible that more such checks might come up in the future (via either Blink or
another embedder's use-case). 

I'll think about it over lunch. :)

[Mike West, 2013/07/30 10:22:43]

How about "resource_is_shared_cross_origin" and "Script::IsSharedCrossOrigin"?
That fits with the notion of ScriptOrigin describing the location of the script
in a resource, and avoids the term "access_check".

WDYT?

[Michael Starzinger, 2013/07/30 10:27:10]

Yep, SGTM, I am fine with that.

       : resource_name_(resource_name),
         resource_line_offset_(resource_line_offset),
-        resource_column_offset_(resource_column_offset) { }
+        resource_column_offset_(resource_column_offset),
+        resource_passed_access_check_(resource_passed_access_check) { }
   V8_INLINE(Handle<Value> ResourceName() const);
   V8_INLINE(Handle<Integer> ResourceLineOffset() const);
   V8_INLINE(Handle<Integer> ResourceColumnOffset() const);
+  V8_INLINE(Handle<Boolean> ResourcePassedAccessCheck() const);
  private:
   Handle<Value> resource_name_;
   Handle<Integer> resource_line_offset_;
   Handle<Integer> resource_column_offset_;
+  Handle<Boolean> resource_passed_access_check_;
 };
 
 
 /**
  * A compiled JavaScript script.
  */
 class V8EXPORT Script {
  public:
   /**
    * Compiles the specified script (context-independent).
@@ skipping 157 matching lines @@
    * the error occurred.
    */
   int GetStartColumn() const;
 
   /**
    * Returns the index within the line of the last character where
    * the error occurred.
    */
   int GetEndColumn() const;
 
+  /**
+   * Returns true if the script in which the exception occurred passed
+   * cross-origin access control checks when originally loaded.

[Michael Starzinger, 2013/07/30 09:52:55]

nit: Can we rephrase the documentation for this method so that it clarifies that
this just threads through the value passed into the ScriptOrigin at compile
time. V8 itself doesn't really perform any access check and in fact is
completely agnostic to the value of this boolean field.

[Mike West, 2013/07/30 10:01:58]

Will do.

+   */
+  bool DidPassAccessCheck() const;

[Michael Starzinger, 2013/07/30 09:52:55]

nit: In light of the above two comments, could I convince you to rename the
method to OriginPassedEmbedderCheck() here?

+
   // TODO(1245381): Print to a string instead of on a FILE.
   static void PrintCurrentStackTrace(FILE* out);
 
   static const int kNoLineNumberInfo = 0;
   static const int kNoColumnInfo = 0;
 };
 
 
 /**
  * Representation of a JavaScript stack trace. The information collected is a
@@ skipping 4826 matching lines @@
 
 Handle<Integer> ScriptOrigin::ResourceLineOffset() const {
   return resource_line_offset_;
 }
 
 
 Handle<Integer> ScriptOrigin::ResourceColumnOffset() const {
   return resource_column_offset_;
 }
 
+Handle<Boolean> ScriptOrigin::ResourcePassedAccessCheck() const {
+  return resource_passed_access_check_;
+}
+
 
 Handle<Boolean> Boolean::New(bool value) {
   return value ? True() : False();
 }
 
 
 void Template::Set(const char* name, v8::Handle<Data> value) {
   Set(v8::String::New(name), value);
 }
 
@@ skipping 492 matching lines @@
 
 
 }  // namespace v8
 
 
 #undef V8EXPORT
 #undef TYPE_CHECK
 
 
 #endif  // V8_H_