Convert SecurityError exceptions to 'es.throwSecurityError()'.

Source/core/page/History.cpp

Index: Source/core/page/History.cpp
diff --git a/Source/core/page/History.cpp b/Source/core/page/History.cpp
index cbda2a60638505b4aa0d8d94792d173488d4edb3..dee3747fe0d140f7ca9e92bb1830c22c041cc576 100644
--- a/Source/core/page/History.cpp
+++ b/Source/core/page/History.cpp
@@ -146,7 +146,8 @@ void History::stateObjectAdded(PassRefPtr<SerializedScriptValue> data, const Str
 
     KURL fullURL = urlForState(urlString);
     if (!fullURL.isValid() || !m_frame->document()->securityOrigin()->canRequest(fullURL)) {
-        es.throwDOMException(SecurityError, "A history state object with URL '" + fullURL.elidedString() + "' cannot be created in a document with origin '" + m_frame->document()->securityOrigin()->toString() + "'.");
+        // We can safely expose the URL to JavaScript, as a) no redirection takes place: JavaScript already had this URL, b) JavaScript can only access a same-origin History object.
+        es.throwSecurityError("A history state object with URL '" + fullURL.elidedString() + "' cannot be created in a document with origin '" + m_frame->document()->securityOrigin()->toString() + "'.");
         return;
     }
     m_frame->loader()->updateForSameDocumentNavigation(fullURL, sameDocumentNavigationSource, data, title);