Call LocalDOMWindow::clearDocument when a frame gets detached

third_party/WebKit/Source/bindings/core/v8/V8DOMWrapper.cpp

 /*
  * Copyright (C) 2009 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 93 matching lines @@
 }
 
 void V8WrapperInstantiationScope::securityCheck(
     v8::Isolate* isolate,
     v8::Local<v8::Context> contextForWrapper) {
   if (m_context.IsEmpty())
     return;
   // If the context is different, we need to make sure that the current
   // context has access to the creation context.
   Frame* frame = toFrameIfNotDetached(contextForWrapper);
-  if (!frame) {
-    // Sandbox detached frames - they can't create cross origin objects.
-    LocalDOMWindow* callingWindow = currentDOMWindow(isolate);
-    DOMWindow* targetWindow = toDOMWindow(contextForWrapper);
-    // TODO(jochen): Currently, Location is the only object for which we can
-    // reach this code path. Should be generalized.
-    ExceptionState exceptionState(ExceptionState::ConstructionContext,
-                                  "Location", contextForWrapper->Global(),
-                                  isolate);
-    if (BindingSecurity::shouldAllowAccessToDetachedWindow(
-            callingWindow, targetWindow, exceptionState))
-      return;
+  if (!frame)
+    return;
 
-    CHECK_EQ(SecurityError, exceptionState.code());
-    return;
-  }
   const DOMWrapperWorld& currentWorld = DOMWrapperWorld::world(m_context);
   RELEASE_ASSERT(currentWorld.worldId() ==
                  DOMWrapperWorld::world(contextForWrapper).worldId());
   // TODO(jochen): Add the interface name here once this is generalized.
   ExceptionState exceptionState(ExceptionState::ConstructionContext, nullptr,
                                 contextForWrapper->Global(), isolate);
   if (currentWorld.isMainWorld() &&
       !BindingSecurity::shouldAllowAccessToFrame(currentDOMWindow(isolate),
                                                  frame, exceptionState)) {
     CHECK_EQ(SecurityError, exceptionState.code());
     return;
   }
 }
 
 void V8WrapperInstantiationScope::convertException() {
   v8::Isolate* isolate = m_context->GetIsolate();
   // TODO(jochen): Currently, Location is the only object for which we can reach
   // this code path. Should be generalized.
   ExceptionState exceptionState(ExceptionState::ConstructionContext, "Location",
                                 isolate->GetCurrentContext()->Global(),
                                 isolate);
   LocalDOMWindow* callingWindow = currentDOMWindow(isolate);
   DOMWindow* targetWindow = toDOMWindow(m_context);
   exceptionState.throwSecurityError(
       targetWindow->sanitizedCrossDomainAccessErrorMessage(callingWindow),
       targetWindow->crossDomainAccessErrorMessage(callingWindow));
 }
 
 }  // namespace blink