Rework security checks to be based on Window rather than Frame.

third_party/WebKit/Source/bindings/core/v8/V8Initializer.cpp

Index: third_party/WebKit/Source/bindings/core/v8/V8Initializer.cpp
diff --git a/third_party/WebKit/Source/bindings/core/v8/V8Initializer.cpp b/third_party/WebKit/Source/bindings/core/v8/V8Initializer.cpp
index 4d58a1bb06a6ee9783962cf7abcfe0f18988f6b1..e7fd3d9ce5297aa7c8777d6cd4948f65c422d310 100644
--- a/third_party/WebKit/Source/bindings/core/v8/V8Initializer.cpp
+++ b/third_party/WebKit/Source/bindings/core/v8/V8Initializer.cpp
@@ -41,14 +41,11 @@
 #include "bindings/core/v8/V8ErrorHandler.h"
 #include "bindings/core/v8/V8GCController.h"
 #include "bindings/core/v8/V8IdleTaskRunner.h"
-#include "bindings/core/v8/V8Location.h"
 #include "bindings/core/v8/V8PerContextData.h"
 #include "bindings/core/v8/V8PrivateProperty.h"
-#include "bindings/core/v8/V8Window.h"
 #include "bindings/core/v8/WorkerOrWorkletScriptController.h"
 #include "core/dom/Document.h"
 #include "core/frame/LocalDOMWindow.h"
-#include "core/frame/LocalFrame.h"
 #include "core/frame/csp/ContentSecurityPolicy.h"
 #include "core/inspector/ConsoleMessage.h"
 #include "core/inspector/MainThreadDebugger.h"
@@ -72,27 +69,6 @@
 
 namespace blink {
 
-static Frame* findFrame(v8::Isolate* isolate,
-                        v8::Local<v8::Object> host,
-                        v8::Local<v8::Value> data) {
-  const WrapperTypeInfo* type = WrapperTypeInfo::unwrap(data);
-
-  if (V8Window::wrapperTypeInfo.equals(type)) {
-    v8::Local<v8::Object> windowWrapper =
-        V8Window::findInstanceInPrototypeChain(host, isolate);
-    if (windowWrapper.IsEmpty())
-      return 0;
-    return V8Window::toImpl(windowWrapper)->frame();
-  }
-
-  if (V8Location::wrapperTypeInfo.equals(type))
-    return V8Location::toImpl(host)->frame();
-
-  // This function can handle only those types listed above.
-  ASSERT_NOT_REACHED();
-  return 0;
-}
-
 static void reportFatalErrorInMainThread(const char* location,
                                          const char* message) {
   int memoryUsageMB = Platform::current()->actualMemoryUsageMB();
@@ -306,11 +282,10 @@ static void promiseRejectHandlerInWorker(v8::PromiseRejectMessage data) {
 static void failedAccessCheckCallbackInMainThread(v8::Local<v8::Object> host,
                                                   v8::AccessType type,
                                                   v8::Local<v8::Value> data) {
-  v8::Isolate* isolate = v8::Isolate::GetCurrent();
-  Frame* target = findFrame(isolate, host, data);
   // FIXME: We should modify V8 to pass in more contextual information (context,
   // property, and object).
-  BindingSecurity::failedAccessCheckFor(isolate, target);
+  BindingSecurity::failedAccessCheckFor(v8::Isolate::GetCurrent(),
+                                        WrapperTypeInfo::unwrap(data), host);

[haraken, 2017/03/07 08:53:57]

This host refers to a holder object, right? Maybe we should rename it to holder.

[dcheng, 2017/03/07 09:06:47]

Done.

 }
 
 static bool codeGenerationCheckCallbackInMainThread(