CHECK correct context usage in V8ScriptRunner::callFunction

third_party/WebKit/Source/bindings/core/v8/V8ScriptRunner.cpp

 /*
  * Copyright (C) 2009 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
  *    documentation and/or other materials provided with the distribution.
  *
  * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
  * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
  * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
  * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
  * THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 #include "bindings/core/v8/V8ScriptRunner.h"
 
+#include "bindings/core/v8/BindingSecurity.h"
 #include "bindings/core/v8/ScriptSourceCode.h"
 #include "bindings/core/v8/ScriptStreamer.h"
 #include "bindings/core/v8/V8Binding.h"
 #include "bindings/core/v8/V8GCController.h"
 #include "bindings/core/v8/V8ThrowException.h"
 #include "core/dom/Document.h"
 #include "core/dom/ExecutionContext.h"
+#include "core/frame/LocalDOMWindow.h"
 #include "core/frame/LocalFrame.h"
 #include "core/frame/PerformanceMonitor.h"
 #include "core/inspector/InspectorTraceEvents.h"
 #include "core/inspector/ThreadDebugger.h"
 #include "core/loader/resource/ScriptResource.h"
 #include "platform/Histogram.h"
 #include "platform/ScriptForbiddenScope.h"
 #include "platform/instrumentation/tracing/TraceEvent.h"
 #include "platform/loader/fetch/CachedMetadata.h"
 #include "public/platform/Platform.h"
@@ skipping 578 matching lines @@
   return result;
 }
 
 v8::MaybeLocal<v8::Value> V8ScriptRunner::callFunction(
     v8::Local<v8::Function> function,
     ExecutionContext* context,
     v8::Local<v8::Value> receiver,
     int argc,
     v8::Local<v8::Value> args[],
     v8::Isolate* isolate) {
-  ScopedFrameBlamer frameBlamer(
-      context->isDocument() ? toDocument(context)->frame() : nullptr);
+  LocalFrame* frame =
+      context->isDocument() ? toDocument(context)->frame() : nullptr;
+  ScopedFrameBlamer frameBlamer(frame);
   TRACE_EVENT0("v8", "v8.callFunction");
 
   int depth = v8::MicrotasksScope::GetCurrentDepth(isolate);
   if (depth >= kMaxRecursionDepth)
     return v8::MaybeLocal<v8::Value>(
         throwStackOverflowExceptionIfNeeded(isolate));
 
   RELEASE_ASSERT(!context->isIteratingOverObservers());
 
   if (ScriptForbiddenScope::isScriptForbidden()) {
     throwScriptForbiddenException(isolate);
     return v8::MaybeLocal<v8::Value>();
   }
   if (!depth)
     TRACE_EVENT_BEGIN1("devtools.timeline", "FunctionCall", "data",
                        InspectorFunctionCallEvent::data(context, function));
 
+  if (frame) {
+    CHECK(BindingSecurity::shouldAllowAccessToFrame(
+        toDOMWindow(function->CreationContext())->toLocalDOMWindow(), frame,
+        BindingSecurity::ErrorReportOption::DoNotReport));
+  }
   CHECK(!ThreadState::current()->isWrapperTracingForbidden());
   v8::MicrotasksScope microtasksScope(isolate,
                                       v8::MicrotasksScope::kRunMicrotasks);
   PerformanceMonitor::willCallFunction(context);
   ThreadDebugger::willExecuteScript(isolate, function->ScriptId());
   v8::MaybeLocal<v8::Value> result =
       function->Call(isolate->GetCurrentContext(), receiver, argc, args);
   crashIfIsolateIsDead(isolate);
   ThreadDebugger::didExecuteScript(isolate);
   PerformanceMonitor::didCallFunction(context, function);
@@ skipping 113 matching lines @@
           v8AtomicString(isolate, "((e) => { throw e; })"), origin)
           .ToLocalChecked();
   v8::Local<v8::Function> thrower = runCompiledInternalScript(isolate, script)
                                         .ToLocalChecked()
                                         .As<v8::Function>();
   v8::Local<v8::Value> args[] = {exception};
   callInternalFunction(thrower, thrower, WTF_ARRAY_LENGTH(args), args, isolate);
 }
 
 }  // namespace blink