Don't skip security checks for javascript: URLs when the JS stack is empty.

third_party/WebKit/Source/bindings/core/v8/ScriptController.h

 /*
  * Copyright (C) 2008, 2009 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 106 matching lines @@
   // Returns true if the current world is isolated, and has its own Content
   // Security Policy. In this case, the policy of the main world should be
   // ignored when evaluating resources injected into the DOM.
   bool shouldBypassMainWorldCSP();
 
   PassRefPtr<SharedPersistent<v8::Object>> createPluginWrapper(Widget*);
 
   void enableEval();
   void disableEval(const String& errorMessage);
 
-  static bool canAccessFromCurrentOrigin(v8::Isolate*, Frame*);
-
   void collectIsolatedContexts(
       Vector<std::pair<ScriptState*, SecurityOrigin*>>&);
 
   bool canExecuteScripts(ReasonForCallingCanExecuteScripts);
 
   TextPosition eventHandlerPosition() const;
 
   void clearWindowProxy();
   void updateDocument();
 
@@ skipping 26 matching lines @@
   v8::Local<v8::Value> evaluateScriptInMainWorld(const ScriptSourceCode&,
                                                  AccessControlStatus,
                                                  ExecuteScriptPolicy);
 
   Member<WindowProxyManager> m_windowProxyManager;
 };
 
 }  // namespace blink
 
 #endif  // ScriptController_h