Invalidate throttling-related dirty bits when changing cross-origin status.

third_party/WebKit/Source/core/dom/Document.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
  *           (C) 2006 Alexey Proskuryakov (ap@webkit.org)
  * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009, 2011, 2012 Apple Inc. All
  * rights reserved.
  * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved.
  * (http://www.torchmobile.com/)
  * Copyright (C) 2008, 2009, 2011, 2012 Google Inc. All rights reserved.
@@ skipping 4634 matching lines @@
     return;
   }
 
   if (result == OriginAccessEntry::MatchesOriginButIsPublicSuffix) {
     exceptionState.throwSecurityError("'" + newDomain +
                                       "' is a top-level domain.");
     return;
   }
 
   getSecurityOrigin()->setDomainFromDOM(newDomain);
+
+  if (view())

[pdr., 2017/02/16 04:04:33]

WDYT of changing this to only make the call when needed?
bool wasCrossDomain = m_frame->isCrossOriginSubframe();
getSecurityOrigin()->setDomainFromDOM(newDomain);
if (view() && (wasCrossDomain != m_frame->isCrossOriginSubframe()))
  view()->crossOriginStatusChanged();

I think the root issue is due to SecurityOrigin's m_domainWasSetInDOM which can
change the cross origin bit (see comment in SecurityOrigin::canAccess).

[chrishtr, 2017/02/16 04:25:25]

Ok.
Correct, this is the root issue.

+    view()->crossOriginStatusChanged();
+
   if (m_frame)
     m_frame->script().updateSecurityOrigin(getSecurityOrigin());
 }
 
 // http://www.whatwg.org/specs/web-apps/current-work/#dom-document-lastmodified
 String Document::lastModified() const {
   DateComponents date;
   bool foundDate = false;
   if (m_frame) {
     if (DocumentLoader* documentLoader = loader()) {
@@ skipping 1922 matching lines @@
 }
 
 void showLiveDocumentInstances() {
   WeakDocumentSet& set = liveDocumentSet();
   fprintf(stderr, "There are %u documents currently alive:\n", set.size());
   for (blink::Document* document : set)
     fprintf(stderr, "- Document %p URL: %s\n", document,
             document->url().getString().utf8().data());
 }
 #endif