Blink bindings: use v8 to enforce method call access checks

third_party/WebKit/Source/core/frame/DOMWindowTimers.cpp

Index: third_party/WebKit/Source/core/frame/DOMWindowTimers.cpp
diff --git a/third_party/WebKit/Source/core/frame/DOMWindowTimers.cpp b/third_party/WebKit/Source/core/frame/DOMWindowTimers.cpp
index ba4232ef62ab4ba376ffb57b022cecbe8d6932a5..aeef8217f0134e24772c6491660eb6f7c1c6158c 100644
--- a/third_party/WebKit/Source/core/frame/DOMWindowTimers.cpp
+++ b/third_party/WebKit/Source/core/frame/DOMWindowTimers.cpp
@@ -49,6 +49,8 @@ static bool isAllowed(ScriptState* scriptState,
                       bool isEval) {
   if (executionContext->isDocument()) {
     Document* document = static_cast<Document*>(executionContext);
+    if (!document->frame())
+      return false;

[dcheng, 2017/02/27 05:34:19]

This is now required, due to a subtle difference between v8's access checks and
Blink's access checks. Otherwise, it crashes in jochen's new CHECK in
ScheduledAction.

In v8, it's OK to access the global of a detached frame: v8 skips the access
check completely due to how the access check is implemented: in
HeapObject::IsAccessCheckNeeded(), there is a special case for JSGlobalProxy. If
the current context's global object is attached as |this|'s global object, the
access check is skipped (e.g. the access is allowed). When a frame is removed
from the DOM, we call WindowProxyManager::clearForClose(), which does *not*
detach the global object from the global proxy. Thus, same-origin access to a
Window object for a detached frame is OK.

However, Blink's access check currently denies access if the DOMWindow has no
frame. Thus, we have a situation where v8 thinks the access is OK, but Blink
thinks it is not OK. So for now, we manually bail out.

I'm working on a separate patch to make access checks in Blink based on Window
=)

[haraken, 2017/02/27 05:49:25]

Sounds reasonable to me.

     if (isEval &&
         !document->contentSecurityPolicy()->allowEval(
             scriptState, ContentSecurityPolicy::SendReport,