Only do security checks on javascript: URLs for frames for loading

third_party/WebKit/Source/bindings/core/v8/ScriptController.cpp

 /*
  * Copyright (C) 2008, 2009 Google Inc. All rights reserved.
  * Copyright (C) 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2014 Opera Software ASA. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
@@ skipping 65 matching lines @@
 #include "wtf/text/CString.h"
 #include "wtf/text/StringBuilder.h"
 #include "wtf/text/TextPosition.h"
 
 namespace blink {
 
 bool ScriptController::canAccessFromCurrentOrigin(v8::Isolate* isolate, Frame* frame)
 {
     if (!frame)
         return false;
-    return !isolate->InContext() || BindingSecurity::shouldAllowAccessToFrame(isolate, currentDOMWindow(isolate), frame, ReportSecurityError);
+    DCHECK(isolate->InContext());
+    return BindingSecurity::shouldAllowAccessToFrame(isolate, currentDOMWindow(isolate), frame, ReportSecurityError);
 }
 
 ScriptController::ScriptController(LocalFrame* frame)
     : m_windowProxyManager(WindowProxyManager::create(*frame))
 {
 }
 
 DEFINE_TRACE(ScriptController)
 {
     visitor->trace(m_windowProxyManager);
@@ skipping 329 matching lines @@
         for (size_t i = 0; i < resultArray->Length(); ++i) {
             v8::Local<v8::Value> value;
             if (!resultArray->Get(scriptState->context(), i).ToLocal(&value))
                 return;
             results->append(value);
         }
     }
 }
 
 } // namespace blink