Don't skip security checks for javascript: URLs when the JS stack is empty.

third_party/WebKit/Source/bindings/core/v8/ScriptController.cpp

 /*
  * Copyright (C) 2008, 2009 Google Inc. All rights reserved.
  * Copyright (C) 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2014 Opera Software ASA. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
@@ skipping 14 matching lines @@
  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
  * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 #include "bindings/core/v8/ScriptController.h"
 
-#include "bindings/core/v8/BindingSecurity.h"
 #include "bindings/core/v8/ScriptSourceCode.h"
 #include "bindings/core/v8/ScriptValue.h"
 #include "bindings/core/v8/V8Binding.h"
 #include "bindings/core/v8/V8Event.h"
 #include "bindings/core/v8/V8GCController.h"
 #include "bindings/core/v8/V8HTMLElement.h"
 #include "bindings/core/v8/V8PerContextData.h"
 #include "bindings/core/v8/V8ScriptRunner.h"
 #include "bindings/core/v8/V8Window.h"
 #include "bindings/core/v8/WindowProxy.h"
@@ skipping 25 matching lines @@
 #include "public/platform/Platform.h"
 #include "wtf/CurrentTime.h"
 #include "wtf/StdLibExtras.h"
 #include "wtf/StringExtras.h"
 #include "wtf/text/CString.h"
 #include "wtf/text/StringBuilder.h"
 #include "wtf/text/TextPosition.h"
 
 namespace blink {
 
-bool ScriptController::canAccessFromCurrentOrigin(v8::Isolate* isolate,
-                                                  Frame* frame) {
-  if (!frame)
-    return false;
-  return !isolate->InContext() ||
-         BindingSecurity::shouldAllowAccessToFrame(
-             currentDOMWindow(isolate), frame,
-             BindingSecurity::ErrorReportOption::Report);
-}
-
 ScriptController::ScriptController(LocalFrame* frame)
     : m_windowProxyManager(WindowProxyManager::create(*frame)) {}
 
 DEFINE_TRACE(ScriptController) {
   visitor->trace(m_windowProxyManager);
 }
 
 void ScriptController::clearForClose() {
   m_windowProxyManager->clearForClose();
   MainThreadDebugger::instance()->didClearContextsForFrame(frame());
@@ skipping 366 matching lines @@
     for (size_t i = 0; i < resultArray->Length(); ++i) {
       v8::Local<v8::Value> value;
       if (!resultArray->Get(scriptState->context(), i).ToLocal(&value))
         return;
       results->append(value);
     }
   }
 }
 
 }  // namespace blink