Fix Runtime.executionContextCreated for crafted iframes.

Source/core/inspector/InjectedScriptManager.cpp

 /*
  * Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
  * Copyright (C) 2008 Matt Lilek <webkit@mattlilek.com>
  * Copyright (C) 2012 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  *
  * 1.  Redistributions of source code must retain the above copyright
@@ skipping 101 matching lines @@
     }
     return InjectedScript();
 }
 
 void InjectedScriptManager::discardInjectedScripts()
 {
     m_idToInjectedScript.clear();
     m_scriptStateToId.clear();
 }
 
-void InjectedScriptManager::discardInjectedScriptsFor(LocalDOMWindow* window)
+void InjectedScriptManager::discardInjectedScriptFor(ScriptState* scriptState)
 {
-    if (m_scriptStateToId.isEmpty())
+    ScriptStateToId::iterator it = m_scriptStateToId.find(scriptState);
+    if (it == m_scriptStateToId.end())
         return;
 
-    Vector<long> idsToRemove;
-    IdToInjectedScriptMap::iterator end = m_idToInjectedScript.end();
-    for (IdToInjectedScriptMap::iterator it = m_idToInjectedScript.begin(); it != end; ++it) {
-        ScriptState* scriptState = it->value.scriptState();
-        if (window != scriptState->domWindow())
-            continue;
-        m_scriptStateToId.remove(scriptState);
-        idsToRemove.append(it->key);
-    }
-    m_idToInjectedScript.removeAll(idsToRemove);
-
-    // Now remove script states that have id but no injected script.
-    Vector<ScriptState*> scriptStatesToRemove;
-    for (ScriptStateToId::iterator it = m_scriptStateToId.begin(); it != m_scriptStateToId.end(); ++it) {
-        ScriptState* scriptState = it->key.get();
-        if (window == scriptState->domWindow())
-            scriptStatesToRemove.append(scriptState);
-    }
-    m_scriptStateToId.removeAll(scriptStatesToRemove);
+    m_idToInjectedScript.remove(it->value);
+    m_scriptStateToId.remove(it);
 }
 
 bool InjectedScriptManager::canAccessInspectedWorkerGlobalScope(ScriptState*)
 {
     return true;
 }
 
 void InjectedScriptManager::releaseObjectGroup(const String& objectGroup)
 {
     Vector<int> keys;
@@ skipping 25 matching lines @@
 
     int id = injectedScriptIdFor(inspectedScriptState);
     ScriptValue injectedScriptValue = createInjectedScript(injectedScriptSource(), inspectedScriptState, id);
     InjectedScript result(injectedScriptValue, m_inspectedStateAccessCheck);
     m_idToInjectedScript.set(id, result);
     return result;
 }
 
 } // namespace blink