Make indexedSecurityCheckCustom more robust

Source/bindings/v8/custom/V8WindowCustom.cpp

 /*
  * Copyright (C) 2009, 2011 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 521 matching lines @@
     if (window.IsEmpty())
         return false;
 
     DOMWindow* targetWindow = V8Window::toNative(window);
 
     ASSERT(targetWindow);
 
     Frame* target = targetWindow->frame();
     if (!target)
         return false;
-    Frame* childFrame =  target->tree()->scopedChild(index);
 
     // Notify the loader's client if the initial document has been accessed.
     if (target->loader()->stateMachine()->isDisplayingInitialEmptyDocument())
         target->loader()->didAccessInitialDocument();
 
+    Frame* childFrame =  target->tree()->scopedChild(index);
+
     // Notice that we can't call HasRealNamedProperty for ACCESS_HAS
     // because that would generate infinite recursion.
     if (type == v8::ACCESS_HAS && childFrame)
         return true;
-    if (type == v8::ACCESS_GET && childFrame && !host->HasRealIndexedProperty(index))
+    if (type == v8::ACCESS_GET
+        && childFrame
+        && !host->HasRealIndexedProperty(index)
+        && !window->HasRealIndexedProperty(index))
         return true;
 
     return BindingSecurity::shouldAllowAccessToFrame(target, DoNotReportSecurityError);
 }
 
 v8::Handle<v8::Value> toV8(DOMWindow* window, v8::Handle<v8::Object> creationContext, v8::Isolate* isolate)
 {
     // Notice that we explicitly ignore creationContext because the DOMWindow is its own creationContext.
 
     if (!window)
@@ skipping 26 matching lines @@
     ASSERT(!global.IsEmpty());
     return global;
 }
 
 v8::Handle<v8::Value> toV8ForMainWorld(DOMWindow* window, v8::Handle<v8::Object> creationContext, v8::Isolate* isolate)
 {
     return toV8(window, creationContext, isolate);
 }
 
 } // namespace WebCore