Move Frame pointer to be held by DOMWindow base class.

third_party/WebKit/Source/core/frame/DOMWindow.h

Index: third_party/WebKit/Source/core/frame/DOMWindow.h
diff --git a/third_party/WebKit/Source/core/frame/DOMWindow.h b/third_party/WebKit/Source/core/frame/DOMWindow.h
index 1b74b48767d05494d1ddf95969f04e1a9f5b5cbc..44f155ce7800ea51195340ffa6b8df9df8768477 100644
--- a/third_party/WebKit/Source/core/frame/DOMWindow.h
+++ b/third_party/WebKit/Source/core/frame/DOMWindow.h
@@ -9,9 +9,10 @@
 #include "core/CoreExport.h"
 #include "core/events/EventTarget.h"
 #include "core/frame/DOMWindowBase64.h"
+#include "core/frame/Frame.h"
 #include "platform/heap/Handle.h"
 #include "platform/scroll/ScrollableArea.h"
-
+#include "wtf/Assertions.h"
 #include "wtf/Forward.h"
 
 namespace blink {
@@ -26,7 +27,6 @@ class DOMVisualViewport;
 class Document;
 class Element;
 class External;
-class Frame;
 class FrameRequestCallback;
 class History;
 class IdleRequestCallback;
@@ -49,14 +49,20 @@ class CORE_EXPORT DOMWindow : public EventTargetWithInlineData,
  public:
   ~DOMWindow() override;
 
+  Frame* frame() const {
+    // If the DOMWindow still has a frame reference, that frame must point
+    // back to this DOMWindow: otherwise, it's easy to get into a situation
+    // where script execution leaks between different DOMWindows.
+    SECURITY_DCHECK(!m_frame || m_frame->domWindow() == this);
+    return m_frame;
+  }
+
   // GarbageCollectedFinalized overrides:
   DECLARE_VIRTUAL_TRACE();
 
   virtual bool isLocalDOMWindow() const = 0;
   virtual bool isRemoteDOMWindow() const = 0;
 
-  virtual Frame* frame() const = 0;
-
   // ScriptWrappable overrides:
   v8::Local<v8::Object> wrap(v8::Isolate*,
                              v8::Local<v8::Object> creationContext) final;
@@ -255,12 +261,18 @@ class CORE_EXPORT DOMWindow : public EventTargetWithInlineData,
   DEFINE_ATTRIBUTE_EVENT_LISTENER(orientationchange);
 
  protected:
-  DOMWindow();
+  explicit DOMWindow(Frame&);
 
   virtual void schedulePostMessage(MessageEvent*,
                                    PassRefPtr<SecurityOrigin> target,
                                    Document* source) = 0;
 
+  void disconnectFromFrame() { m_frame = nullptr; }
+
+ private:
+  Member<Frame> m_frame;
+  mutable Member<Location> m_location;
+
   // Set to true when close() has been called. Needed for
   // |window.closed| determinism; having it return 'true'
   // only after the layout widget's deferred window close
@@ -268,8 +280,6 @@ class CORE_EXPORT DOMWindow : public EventTargetWithInlineData,
   // implementation details to scripts.
   bool m_windowIsClosing;
 
- private:
-  mutable Member<Location> m_location;
 };
 
 }  // namespace blink