Pipe a script's CORS status through V8 during compilation.

include/v8.h

Index: include/v8.h
diff --git a/include/v8.h b/include/v8.h
index 36077402a287046e84cf5f4dc8c1d6bd120a3ab3..ac912343e31439f6b9c28f40dbd4ac6ca6b69583 100644
--- a/include/v8.h
+++ b/include/v8.h
@@ -942,17 +942,21 @@ class ScriptOrigin {
   V8_INLINE(ScriptOrigin(
       Handle<Value> resource_name,
       Handle<Integer> resource_line_offset = Handle<Integer>(),
-      Handle<Integer> resource_column_offset = Handle<Integer>()))
+      Handle<Integer> resource_column_offset = Handle<Integer>(),
+      Handle<Boolean> resource_passed_access_check = Handle<Boolean>()))

[Michael Starzinger, 2013/07/30 09:52:55]

The term "access check" is already used in the API to describe something else.
The semantics of this boolean field are completely up to the embedder (i.e.
Chromium). Could I convince you to use a different term here? One suggestion
would be "embedder check", but I am open towards alternatives.

[Mike West, 2013/07/30 10:01:58]

The goal is to allow the embedder to determine whether or not an exception
(Message) has been thrown from a Script that was loaded in such a way as to
allow exception details to be visible. In practice, this means that the script
was loaded with an 'Access-Control-Allow-Origin' header.

You're correct to say that this is embedder-specific. I'm not sure that node
would care, for instance.

I'd prefer something more specific than "embedder check", as it's entirely
possible that more such checks might come up in the future (via either Blink or
another embedder's use-case). 

I'll think about it over lunch. :)

[Mike West, 2013/07/30 10:22:43]

How about "resource_is_shared_cross_origin" and "Script::IsSharedCrossOrigin"?
That fits with the notion of ScriptOrigin describing the location of the script
in a resource, and avoids the term "access_check".

WDYT?

[Michael Starzinger, 2013/07/30 10:27:10]

Yep, SGTM, I am fine with that.

       : resource_name_(resource_name),
         resource_line_offset_(resource_line_offset),
-        resource_column_offset_(resource_column_offset) { }
+        resource_column_offset_(resource_column_offset),
+        resource_passed_access_check_(resource_passed_access_check) { }
   V8_INLINE(Handle<Value> ResourceName() const);
   V8_INLINE(Handle<Integer> ResourceLineOffset() const);
   V8_INLINE(Handle<Integer> ResourceColumnOffset() const);
+  V8_INLINE(Handle<Boolean> ResourcePassedAccessCheck() const);
  private:
   Handle<Value> resource_name_;
   Handle<Integer> resource_line_offset_;
   Handle<Integer> resource_column_offset_;
+  Handle<Boolean> resource_passed_access_check_;
 };
 
 
@@ -1130,6 +1134,12 @@ class V8EXPORT Message {
    */
   int GetEndColumn() const;
 
+  /**
+   * Returns true if the script in which the exception occurred passed
+   * cross-origin access control checks when originally loaded.

[Michael Starzinger, 2013/07/30 09:52:55]

nit: Can we rephrase the documentation for this method so that it clarifies that
this just threads through the value passed into the ScriptOrigin at compile
time. V8 itself doesn't really perform any access check and in fact is
completely agnostic to the value of this boolean field.

[Mike West, 2013/07/30 10:01:58]

Will do.

+   */
+  bool DidPassAccessCheck() const;

[Michael Starzinger, 2013/07/30 09:52:55]

nit: In light of the above two comments, could I convince you to rename the
method to OriginPassedEmbedderCheck() here?

+
   // TODO(1245381): Print to a string instead of on a FILE.
   static void PrintCurrentStackTrace(FILE* out);
 
@@ -5976,6 +5986,10 @@ Handle<Integer> ScriptOrigin::ResourceColumnOffset() const {
   return resource_column_offset_;
 }
 
+Handle<Boolean> ScriptOrigin::ResourcePassedAccessCheck() const {
+  return resource_passed_access_check_;
+}
+
 
 Handle<Boolean> Boolean::New(bool value) {
   return value ? True() : False();