Merge 111098

Source/WebCore/bindings/v8/custom/V8DOMWindowCustom.cpp

 /*
  * Copyright (C) 2009, 2011 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 408 matching lines @@
 
 static void setUpDialog(DOMWindow* dialog, void* handler)
 {
     static_cast<DialogHandler*>(handler)->dialogCreated(dialog);
 }
 
 v8::Handle<v8::Value> V8DOMWindow::showModalDialogCallback(const v8::Arguments& args)
 {
     INC_STATS("DOM.DOMWindow.showModalDialog()");
     DOMWindow* impl = V8DOMWindow::toNative(args.Holder());
+    V8BindingState* state = V8BindingState::Only();
+    if (!V8BindingSecurity::canAccessFrame(state, impl->frame(), true))
+        return v8::Undefined();
 
-    V8BindingState* state = V8BindingState::Only();
+    // FIXME: Handle exceptions properly.
+    String urlString = toWebCoreStringWithNullOrUndefinedCheck(args[0]);
+    DialogHandler handler(args[1]);
+    String dialogFeaturesString = toWebCoreStringWithNullOrUndefinedCheck(args[2]);
 
     DOMWindow* activeWindow = state->activeWindow();
     DOMWindow* firstWindow = state->firstWindow();
-
-    // FIXME: Handle exceptions properly.
-    String urlString = toWebCoreStringWithNullOrUndefinedCheck(args[0]);
-    String dialogFeaturesString = toWebCoreStringWithNullOrUndefinedCheck(args[2]);
-
-    DialogHandler handler(args[1]);
-
     impl->showModalDialog(urlString, dialogFeaturesString, activeWindow, firstWindow, setUpDialog, &handler);
 
     return handler.returnValue();
 }
 
 v8::Handle<v8::Value> V8DOMWindow::openCallback(const v8::Arguments& args)
 {
     INC_STATS("DOM.DOMWindow.open()");
     DOMWindow* impl = V8DOMWindow::toNative(args.Holder());
-
     V8BindingState* state = V8BindingState::Only();
-
-    DOMWindow* activeWindow = state->activeWindow();
-    DOMWindow* firstWindow = state->firstWindow();
+    if (!V8BindingSecurity::canAccessFrame(state, impl->frame(), true))
+        return v8::Undefined();
 
     // FIXME: Handle exceptions properly.
     String urlString = toWebCoreStringWithNullOrUndefinedCheck(args[0]);
     AtomicString frameName = (args[1]->IsUndefined() || args[1]->IsNull()) ? "_blank" : AtomicString(toWebCoreString(args[1]));
     String windowFeaturesString = toWebCoreStringWithNullOrUndefinedCheck(args[2]);
 
+    DOMWindow* activeWindow = state->activeWindow();
+    DOMWindow* firstWindow = state->firstWindow();
     RefPtr<DOMWindow> openedWindow = impl->open(urlString, frameName, windowFeaturesString, activeWindow, firstWindow);
     if (!openedWindow)
         return v8::Undefined();
+
     return toV8(openedWindow.release());
 }
 
 v8::Handle<v8::Value> V8DOMWindow::indexedPropertyGetter(uint32_t index, const v8::AccessorInfo& info)
 {
     INC_STATS("DOM.DOMWindow.IndexedPropertyGetter");
 
     DOMWindow* window = V8DOMWindow::toNative(info.Holder());
     if (!window)
         return notHandledByInterceptor();
@@ skipping 147 matching lines @@
     v8::Handle<v8::Context> context = V8Proxy::context(frame);
     if (context.IsEmpty())
         return v8::Handle<v8::Object>();
 
     v8::Handle<v8::Object> global = context->Global();
     ASSERT(!global.IsEmpty());
     return global;
 }
 
 } // namespace WebCore