Throw security errors for attribute access on detached windows.

third_party/WebKit/Source/bindings/core/v8/BindingSecurity.cpp

 /*
  * Copyright (C) 2009 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 236 matching lines @@
   // Note that there is no need to call back
   // FrameLoader::didAccessInitialDocument() because |targetWindow| must be
   // a child window inside iframe or frame and it doesn't have a URL bar,
   // so there is no need to worry about URL spoofing.
 
   return true;
 }
 
 void BindingSecurity::failedAccessCheckFor(v8::Isolate* isolate,
                                            const Frame* target) {
-  // TODO(dcheng): See if this null check can be removed or hoisted to a
-  // different location.
-  if (!target)
-    return;
-
-  DOMWindow* targetWindow = target->domWindow();
-
   // TODO(dcheng): Add ContextType, interface name, and property name as
   // arguments, so the generated exception can be more descriptive.
   ExceptionState exceptionState(isolate, ExceptionState::UnknownContext,
                                 nullptr, nullptr);
+
+  LocalDOMWindow* callingWindow = currentDOMWindow(isolate);

[haraken, 2017/02/19 09:14:10]

Nit: callingWindow => currentWindow

(We removed the concept of CallingContext.)

[dcheng, 2017/02/19 09:19:46]

Yeah, the reason I named it like this is for consistency with the
crossDomainAccessErrorMessage's and sanitizedCrossDomainAccessErrorMessage's
argument. Is it OK to fix this in a followup?

+  if (!target) {
+    const SecurityOrigin* activeOrigin =
+        callingWindow->document()->getSecurityOrigin();
+    String message = "Blocked a frame with origin \"" +
+                     activeOrigin->toString() +
+                     "\" from accessing a detached cross-origin frame";
+    exceptionState.throwSecurityError(message, message);
+    return;
+  }
+
+  DOMWindow* targetWindow = target->domWindow();
+
   exceptionState.throwSecurityError(
-      targetWindow->sanitizedCrossDomainAccessErrorMessage(
-          currentDOMWindow(isolate)),
-      targetWindow->crossDomainAccessErrorMessage(currentDOMWindow(isolate)));
+      targetWindow->sanitizedCrossDomainAccessErrorMessage(callingWindow),
+      targetWindow->crossDomainAccessErrorMessage(callingWindow));
 }
 
 }  // namespace blink