Special-case LocalDOMWindow for same-origin access in bindings.

third_party/WebKit/Source/bindings/core/v8/BindingSecurity.cpp

 /*
  * Copyright (C) 2009 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 198 matching lines @@
                         target->domWindow(), reportingOption);
 }
 
 bool BindingSecurity::shouldAllowAccessToDetachedWindow(
     const LocalDOMWindow* accessingWindow,
     const DOMWindow* target,
     ExceptionState& exceptionState) {
   CHECK(target && !target->frame())
       << "This version of shouldAllowAccessToFrame() must be used only for "
       << "detached windows.";
-  if (!target->document())
+  if (!target->isLocalDOMWindow())
     return false;
-  return canAccessFrame(accessingWindow,
-                        target->document()->getSecurityOrigin(), target,
+  Document* document = toLocalDOMWindow(target)->document();

[dcheng, 2017/02/01 07:22:59]

I am considering moving SecurityContext to DOMWindow, but it doesn't seem like
it will gain us much either. Either way, I'll investigate in a followup.

+  if (!document)
+    return false;
+  return canAccessFrame(accessingWindow, document->getSecurityOrigin(), target,
                         exceptionState);
 }
 
 bool BindingSecurity::shouldAllowNamedAccessTo(const DOMWindow* accessingWindow,
                                                const DOMWindow* targetWindow) {
   const Frame* accessingFrame = accessingWindow->frame();
   DCHECK(accessingFrame);
   DCHECK(accessingFrame->securityContext());
   const SecurityOrigin* accessingOrigin =
       accessingFrame->securityContext()->getSecurityOrigin();
@@ skipping 30 matching lines @@
   // arguments, so the generated exception can be more descriptive.
   ExceptionState exceptionState(isolate, ExceptionState::UnknownContext,
                                 nullptr, nullptr);
   exceptionState.throwSecurityError(
       targetWindow->sanitizedCrossDomainAccessErrorMessage(
           currentDOMWindow(isolate)),
       targetWindow->crossDomainAccessErrorMessage(currentDOMWindow(isolate)));
 }
 
 }  // namespace blink