Index: third_party/WebKit/Source/bindings/core/v8/V8LazyEventListener.cpp |
diff --git a/third_party/WebKit/Source/bindings/core/v8/V8LazyEventListener.cpp b/third_party/WebKit/Source/bindings/core/v8/V8LazyEventListener.cpp |
index 046d1ebe7d302cf126935205f0c7c8d808771183..1c15c76c0bdd55b7d90666cd3f919bbda175db8d 100644 |
--- a/third_party/WebKit/Source/bindings/core/v8/V8LazyEventListener.cpp |
+++ b/third_party/WebKit/Source/bindings/core/v8/V8LazyEventListener.cpp |
@@ -105,6 +105,10 @@ v8::Local<v8::Value> V8LazyEventListener::callListenerFunction( |
AboutToExecuteScript)) |
return v8::Local<v8::Value>(); |
+ CHECK(BindingSecurity::shouldAllowAccessToFrame( |
+ toDOMWindow(handlerFunction->CreationContext())->toLocalDOMWindow(), |
+ frame, BindingSecurity::ErrorReportOption::DoNotReport)); |
+ |
v8::Local<v8::Value> parameters[1] = {jsEvent}; |
v8::Local<v8::Value> result; |
if (!V8ScriptRunner::callFunction(handlerFunction, frame->document(), |