WebCore:

WebCore:

        Reviewed by Geoff.

        Fix <rdar://problem/5698200>
        eBay photo uploading hangs and causes slow script warning to pop up

        In a case like this

            var f = window.parent.parentFunction;
            document.domain = document.domain; // this makes window.parent inaccessible
            f();

        Firefox allows parentFunction to access parents properties. Match this behavior.

        In a domain security check against the dynamic global object fails for the specific reason that one of
        the frames has written to the document.domain property and another has not (but they match otherwise),
        then recheck against the lexical global object.

        Test: http/tests/security/cross-frame-access-callback-explicit-domain-ALLOW.html
              http/tests/security/cross-frame-access-callback-explicit-domain-DENY.html

        * bindings/js/kjs_window.cpp:
        (KJS::Window::allowsAccessFrom):
        (KJS::Window::printErrorMessage):
        * bindings/js/kjs_window.h:
        * loader/FrameLoader.cpp:
        (WebCore::FrameLoader::shouldAllowNavigation):
        * platform/SecurityOrigin.cpp:
        (WebCore::SecurityOrigin::canAccess):
        * platform/SecurityOrigin.h:
        (WebCore::SecurityOrigin::):

LayoutTests:

        Reviewed by Geoff.

        Test for <rdar://problem/5698200>
        eBay photo uploading hangs and causes slow script warning to pop up

        * http/tests/security/cross-frame-access-callback-explicit-domain-ALLOW-expected.txt: Added.
        * http/tests/security/cross-frame-access-callback-explicit-domain-ALLOW.html: Added.
        * http/tests/security/cross-frame-access-callback-explicit-domain-DENY-expected.txt: Added.
        * http/tests/security/cross-frame-access-callback-explicit-domain-DENY.html: Added.
        * http/tests/security/resources/cross-frame-iframe-callback-explicit-domain-ALLOW.html: Added.
        * http/tests/security/resources/cross-frame-iframe-callback-explicit-domain-DENY.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@30009 268f45cc-cd09-0410-ab3c-d52691b4dbfc