Rework security checks to be based on Window rather than Frame.

third_party/WebKit/Source/bindings/core/v8/custom/V8WindowCustom.cpp

 /*
  * Copyright (C) 2009, 2011 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 141 matching lines @@
       ToV8(impl->frameElement(), v8::Local<v8::Object>::Cast(creation_context),
            info.GetIsolate());
   V8SetReturnValue(info, wrapper);
 }
 
 void V8Window::openerAttributeSetterCustom(
     v8::Local<v8::Value> value,
     const v8::PropertyCallbackInfo<void>& info) {
   v8::Isolate* isolate = info.GetIsolate();
   DOMWindow* impl = V8Window::toImpl(info.Holder());
-  // TODO(dcheng): Investigate removing this, since opener is not really a
-  // cross-origin property (so it shouldn't be accessible to begin with)
-  ExceptionState exception_state(isolate, ExceptionState::kSetterContext,
-                                 "Window", "opener");
-  if (!BindingSecurity::ShouldAllowAccessTo(CurrentDOMWindow(info.GetIsolate()),
-                                            impl, exception_state)) {
+  if (!impl->GetFrame())
     return;
-  }
 
   // Opener can be shadowed if it is in the same domain.
   // Have a special handling of null value to behave
   // like Firefox. See bug http://b/1224887 & http://b/791706.
   if (value->IsNull()) {
     // impl->frame() has to be a non-null LocalFrame.  Otherwise, the
     // same-origin check would have failed.
     DCHECK(impl->GetFrame());
     ToLocalFrame(impl->GetFrame())->Loader().SetOpener(0);
   }
@@ skipping 162 matching lines @@
     // window.  Then, removes the following two lines.
     V8SetReturnValueFast(info, child->DomWindow(), window);
     return;
   }
 
   // This is a cross-origin interceptor. Check that the caller has access to the
   // named results.
   if (!BindingSecurity::ShouldAllowAccessTo(
           CurrentDOMWindow(info.GetIsolate()), window,
           BindingSecurity::ErrorReportOption::kDoNotReport)) {
-    BindingSecurity::FailedAccessCheckFor(info.GetIsolate(), frame);
+    BindingSecurity::FailedAccessCheckFor(
+        info.GetIsolate(), window->GetWrapperTypeInfo(), info.Holder());
     return;
   }
 
   // Search named items in the document.
   Document* doc = ToLocalFrame(frame)->GetDocument();
   if (!doc || !doc->IsHTMLDocument())
     return;
 
   bool has_named_item = ToHTMLDocument(doc)->HasNamedItem(name);
   bool has_id_item = doc->HasElementWithId(name);
@@ skipping 18 matching lines @@
     if (items->HasExactlyOneItem()) {
       V8SetReturnValueFast(info, items->item(0), window);
       return;
     }
     V8SetReturnValueFast(info, items, window);
     return;
   }
 }
 
 }  // namespace blink