Simplify security token setting logic in WindowProxy

third_party/WebKit/Source/bindings/core/v8/WindowProxy.cpp

 /*
  * Copyright (C) 2008, 2009, 2011 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 409 matching lines @@
     m_scriptState->perContextData()->setActivityLogger(V8DOMActivityLogger::activityLogger(
         m_world->worldId(), m_frame->isLocalFrame() && toLocalFrame(m_frame)->document() ? toLocalFrame(m_frame)->document()->baseURI() : KURL()));
 }
 
 void WindowProxy::setSecurityToken(SecurityOrigin* origin)
 {
     // If two tokens are equal, then the SecurityOrigins canAccess each other.
     // If two tokens are not equal, then we have to call canAccess.
     // Note: we can't use the HTTPOrigin if it was set from the DOM.
     String token;
-    // There are several situations where v8 needs to do a full canAccess check,
+    // There are two situations where v8 needs to do a full canAccess check,
     // so set an empty security token instead:
     // - document.domain was modified
-    // - the frame is showing the initial empty document
     // - the frame is remote
-    bool delaySet = m_frame->isRemoteFrame() || (m_world->isMainWorld() && (origin->domainWasSetInDOM() || toLocalFrame(m_frame)->loader().stateMachine()->isDisplayingInitialEmptyDocument()));
+    bool delaySet = m_frame->isRemoteFrame() || (m_world->isMainWorld() && origin->domainWasSetInDOM());

[dcheng, 2016/08/18 00:45:12]

Note: I'm not actually sure why the second part of this condition requires that
we only delay it for the main world. Does document.domain not affect other
worlds?

     if (origin && !delaySet)
         token = origin->toString();
 
     // An empty or "null" token means we always have to call
     // canAccess. The toString method on securityOrigins returns the
     // string "null" for empty security origins and for security
     // origins that should only allow access to themselves. In this
     // case, we use the global object as the security token to avoid
     // calling canAccess when a script accesses its own objects.
     v8::HandleScope handleScope(m_isolate);
@@ skipping 108 matching lines @@
 }
 
 void WindowProxy::updateSecurityOrigin(SecurityOrigin* origin)
 {
     if (!isContextInitialized())
         return;
     setSecurityToken(origin);
 }
 
 } // namespace blink