Move Frame pointer to be held by DOMWindow base class.

third_party/WebKit/Source/core/frame/DOMWindow.h

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef DOMWindow_h
 #define DOMWindow_h
 
 #include "bindings/core/v8/Transferables.h"
 #include "core/CoreExport.h"
 #include "core/events/EventTarget.h"
 #include "core/frame/DOMWindowBase64.h"
+#include "core/frame/Frame.h"
 #include "platform/heap/Handle.h"
 #include "platform/scroll/ScrollableArea.h"
-
+#include "wtf/Assertions.h"
 #include "wtf/Forward.h"
 
 namespace blink {
 
 class ApplicationCache;
 class BarProp;
 class CSSRuleList;
 class CSSStyleDeclaration;
 class CustomElementRegistry;
 class DOMSelection;
 class DOMVisualViewport;
 class Document;
 class Element;
 class External;
-class Frame;
 class FrameRequestCallback;
 class History;
 class IdleRequestCallback;
 class IdleRequestOptions;
 class Location;
 class LocalDOMWindow;
 class MessageEvent;
 class MediaQueryList;
 class Navigator;
 class Screen;
 class ScriptState;
 class ScrollToOptions;
 class SerializedScriptValue;
 class StyleMedia;
 
 class CORE_EXPORT DOMWindow : public EventTargetWithInlineData,
                               public DOMWindowBase64 {
   DEFINE_WRAPPERTYPEINFO();
 
  public:
   ~DOMWindow() override;
 
+  Frame* frame() const {
+    // If the DOMWindow still has a frame reference, that frame must point
+    // back to this DOMWindow: otherwise, it's easy to get into a situation
+    // where script execution leaks between different DOMWindows.
+    SECURITY_DCHECK(!m_frame || m_frame->domWindow() == this);
+    return m_frame;
+  }
+
   // GarbageCollectedFinalized overrides:
   DECLARE_VIRTUAL_TRACE();
 
   virtual bool isLocalDOMWindow() const = 0;
   virtual bool isRemoteDOMWindow() const = 0;
 
-  virtual Frame* frame() const = 0;
-
   // ScriptWrappable overrides:
   v8::Local<v8::Object> wrap(v8::Isolate*,
                              v8::Local<v8::Object> creationContext) final;
   v8::Local<v8::Object> associateWithWrapper(
       v8::Isolate*,
       const WrapperTypeInfo*,
       v8::Local<v8::Object> wrapper) final;
 
   // EventTarget overrides:
   const AtomicString& interfaceName() const override;
@@ skipping 178 matching lines @@
   DEFINE_MAPPED_ATTRIBUTE_EVENT_LISTENER(webkitanimationiteration,
                                          webkitAnimationIteration);
   DEFINE_MAPPED_ATTRIBUTE_EVENT_LISTENER(webkitanimationend,
                                          webkitAnimationEnd);
   DEFINE_MAPPED_ATTRIBUTE_EVENT_LISTENER(webkittransitionend,
                                          webkitTransitionEnd);
 
   DEFINE_ATTRIBUTE_EVENT_LISTENER(orientationchange);
 
  protected:
-  DOMWindow();
+  explicit DOMWindow(Frame&);
 
   virtual void schedulePostMessage(MessageEvent*,
                                    PassRefPtr<SecurityOrigin> target,
                                    Document* source) = 0;
 
+  void disconnectFromFrame() { m_frame = nullptr; }
+
+ private:
+  Member<Frame> m_frame;
+  mutable Member<Location> m_location;
+
   // Set to true when close() has been called. Needed for
   // |window.closed| determinism; having it return 'true'
   // only after the layout widget's deferred window close
   // operation has been performed, exposes (confusing)
   // implementation details to scripts.
   bool m_windowIsClosing;
 
- private:
-  mutable Member<Location> m_location;
 };
 
 }  // namespace blink
 
 #endif  // DOMWindow_h