Rework security checks to be based on Window rather than Frame.

third_party/WebKit/Source/bindings/core/v8/custom/V8WindowCustom.cpp

 /*
  * Copyright (C) 2009, 2011 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 178 matching lines @@
       ToV8(impl->frameElement(), v8::Local<v8::Object>::Cast(creationContext),
            info.GetIsolate());
   v8SetReturnValue(info, wrapper);
 }
 
 void V8Window::openerAttributeSetterCustom(
     v8::Local<v8::Value> value,
     const v8::PropertyCallbackInfo<void>& info) {
   v8::Isolate* isolate = info.GetIsolate();
   DOMWindow* impl = V8Window::toImpl(info.Holder());
-  // TODO(dcheng): Investigate removing this, since opener is not really a
-  // cross-origin property (so it shouldn't be accessible to begin with)
-  ExceptionState exceptionState(isolate, ExceptionState::SetterContext,
-                                "Window", "opener");
-  if (!BindingSecurity::shouldAllowAccessTo(currentDOMWindow(info.GetIsolate()),
-                                            impl, exceptionState)) {
+  if (!impl->frame())
     return;
-  }
 
   // Opener can be shadowed if it is in the same domain.
   // Have a special handling of null value to behave
   // like Firefox. See bug http://b/1224887 & http://b/791706.
   if (value->IsNull()) {
     // impl->frame() has to be a non-null LocalFrame.  Otherwise, the
     // same-origin check would have failed.
     ASSERT(impl->frame());
     toLocalFrame(impl->frame())->loader().setOpener(0);
   }
@@ skipping 136 matching lines @@
       v8SetReturnValueFast(info, child->domWindow(), window);
       return;
     }
   }
 
   // This is a cross-origin interceptor. Check that the caller has access to the
   // named results.
   if (!BindingSecurity::shouldAllowAccessTo(
           currentDOMWindow(info.GetIsolate()), window,
           BindingSecurity::ErrorReportOption::DoNotReport)) {
-    BindingSecurity::failedAccessCheckFor(info.GetIsolate(), frame);
+    BindingSecurity::failedAccessCheckFor(
+        info.GetIsolate(), &V8Window::wrapperTypeInfo, info.Holder());
     return;
   }
 
   // Search named items in the document.
   Document* doc = toLocalFrame(frame)->document();
   if (!doc || !doc->isHTMLDocument())
     return;
 
   bool hasNamedItem = toHTMLDocument(doc)->hasNamedItem(name);
   bool hasIdItem = doc->hasElementWithId(name);
@@ skipping 18 matching lines @@
     if (items->hasExactlyOneItem()) {
       v8SetReturnValueFast(info, items->item(0), window);
       return;
     }
     v8SetReturnValueFast(info, items, window);
     return;
   }
 }
 
 }  // namespace blink