CHECK correct context usage in V8ScriptRunner::callFunction

third_party/WebKit/Source/bindings/core/v8/V8EventListener.cpp

 /*
  * Copyright (C) 2006, 2007, 2008, 2009 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 12 matching lines @@
  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
  * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 #include "bindings/core/v8/V8EventListener.h"
 
+#include "bindings/core/v8/BindingSecurity.h"
 #include "bindings/core/v8/ScriptController.h"
 #include "bindings/core/v8/V8Binding.h"
 #include "core/dom/Document.h"
 #include "core/events/Event.h"
 #include "core/frame/LocalFrame.h"
 
 namespace blink {
 
 V8EventListener::V8EventListener(bool isAttribute, ScriptState* scriptState)
     : V8AbstractEventListener(isAttribute,
@@ skipping 50 matching lines @@
   if (handlerFunction.IsEmpty() || receiver.IsEmpty())
     return v8::Local<v8::Value>();
 
   if (!scriptState->getExecutionContext()->isDocument())
     return v8::Local<v8::Value>();
 
   LocalFrame* frame = toDocument(scriptState->getExecutionContext())->frame();
   if (!frame)
     return v8::Local<v8::Value>();
 
-  // TODO(jochen): Consider moving this check into canExecuteScripts.
-  // http://crbug.com/608641
-  if (scriptState->world().isMainWorld() &&
-      !scriptState->getExecutionContext()->canExecuteScripts(
-          AboutToExecuteScript))
-    return v8::Local<v8::Value>();
+  if (scriptState->world().isMainWorld()) {
+    // TODO(jochen): Consider moving this check into canExecuteScripts.
+    // http://crbug.com/608641
+    if (!scriptState->getExecutionContext()->canExecuteScripts(
+            AboutToExecuteScript)) {
+      return v8::Local<v8::Value>();
+    }
+
+    CHECK(BindingSecurity::shouldAllowAccessToFrame(
+        toDOMWindow(handlerFunction->CreationContext())->toLocalDOMWindow(),
+        frame, BindingSecurity::ErrorReportOption::DoNotReport));

[haraken, 2017/02/20 10:01:55]

Another idea would be to move the CHECK into V8ScriptRunner::callFunction?

+  }
 
   v8::Local<v8::Value> parameters[1] = {jsEvent};
   v8::Local<v8::Value> result;
   if (!V8ScriptRunner::callFunction(handlerFunction, frame->document(),
                                     receiver, WTF_ARRAY_LENGTH(parameters),
                                     parameters, scriptState->isolate())
-           .ToLocal(&result))
+           .ToLocal(&result)) {
     return v8::Local<v8::Value>();
+  }
   return result;
 }
 
 }  // namespace blink