Make indexedSecurityCheckCustom more robust

Make indexedSecurityCheckCustom more robust

I don't know any way in which this change is observable, but this CL makes
indexedSecurityCheckCustom match namedSecurityCheckCustom in form.

BUG=257748
R=adamk

Committed: https://src.chromium.org/viewvc/blink?view=rev&revision=153929

[adamk, 2013-07-09 21:44:54]

Sure would be nice to have a test for this (likely something related to holding
onto a global of a navigated frame), but it's certainly no worse than it was
before. lgtm.

[abarth-chromium, 2013-07-09 21:54:05]

I can look up the test case that caused us to add this check in the
named-property case...

[Tom Sepez, 2013-07-09 22:07:39]

Perhaps this code change would catch the case where the parent does
    window.__proto__[0] = { a: 1 };
and then an iframe from a different domain tries to get
    x = top[0].

[abarth-chromium, 2013-07-09 22:32:00]

Looking at the test cases for named properties, I don't think this change is
observable.

    // outerGlobalObject (Empty object, remains after navigation)
    //   -- has prototype --> innerGlobalObject (Holds global variables, changes
during navigation)
    //   -- has prototype --> DOMWindow instance
                               ^^^^ You'd need to give this object some index
properties, which I don't think is possible.
    //   -- has prototype --> Window.prototype
    //   -- has prototype --> Object.prototype

[commit-bot: I haz the power, 2013-07-09 22:32:21]

CQ is trying da patch. Follow status at
https://chromium-status.appspot.com/cq/abarth@chromium.org/18558007/1

[commit-bot: I haz the power, 2013-07-09 23:46:26]

Retried try job too often on linux_layout_rel for step(s) webkit_tests
http://build.chromium.org/p/tryserver.chromium/buildstatus?builder=linux_layo...

[commit-bot: I haz the power, 2013-07-10 20:14:46]

CQ is trying da patch. Follow status at
https://chromium-status.appspot.com/cq/abarth@chromium.org/18558007/1

[commit-bot: I haz the power, 2013-07-10 21:18:55]

Change committed as 153929