Throw security errors for attribute access on detached windows.

third_party/WebKit/Source/bindings/core/v8/V8Initializer.cpp

 /*
  * Copyright (C) 2009 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 51 matching lines @@
 #include "public/platform/WebScheduler.h"
 #include "public/platform/WebThread.h"
 #include "wtf/AddressSanitizer.h"
 #include "wtf/PtrUtil.h"
 #include "wtf/RefPtr.h"
 #include "wtf/text/WTFString.h"
 #include "wtf/typed_arrays/ArrayBufferContents.h"
 
 namespace blink {
 
+// TODO(dcheng): This function should be changed to return a DOMWindow.
+// Returning Frame is problematic, as detached DOMWindow/Location objects do not
+// point back to a Frame. For Window, this is not a problem: the security origin
+// can still be determined from the Document. However, Blink currently violates
+// the HTML standard for Location [1] and only has one Location object for the
+// Frame; this makes it impossible to determine the security origin of the a
+// detached Location object.
+//
+// From https://whatwg.org/C/browsers.html#the-location-interface:
+// Each Window object is associated with a unique instance of a Location object,
+// allocated when the Window object is created.
 static Frame* findFrame(v8::Isolate* isolate,
                         v8::Local<v8::Object> host,
                         v8::Local<v8::Value> data) {
   const WrapperTypeInfo* type = WrapperTypeInfo::unwrap(data);
 
   if (V8Window::wrapperTypeInfo.equals(type)) {
     v8::Local<v8::Object> windowWrapper =
         V8Window::findInstanceInPrototypeChain(host, isolate);
     if (windowWrapper.IsEmpty())
       return 0;
@@ skipping 434 matching lines @@
           v8::Isolate::kMessageLog);
   isolate->SetFatalErrorHandler(reportFatalErrorInWorker);
 
   uint32_t here;
   isolate->SetStackLimit(reinterpret_cast<uintptr_t>(&here) -
                          kWorkerMaxStackSize);
   isolate->SetPromiseRejectCallback(promiseRejectHandlerInWorker);
 }
 
 }  // namespace blink