add security fix to webkit

do not merge

bug is described by http://b/issue?id=1892983 (23148)
originally fixed by http://trac.webkit.org/changeset/42216

with this fix in place, these exploits fail:

http://evil.webblaze.org/jww/tests/location-exploit.html
  generates:
D/WebCore (  788): Console: Unsafe JavaScript attempt to access frame with URL http://evil.webblaze.org/jww/tests/location-exploit.html from frame with URL http://good.webblaze.org/jww/tests/location-exploit-iframe.html. Domains, protocols and ports must match.
D/WebCore (  788):  line: 1 source:
D/WebCore (  788): Console: TypeError: Result of expression 'location.__defineGetter__.argumentNames' [undefined] is not a function. line: 3 source: http://evil.webblaze.org/jww/tests/location-exploit.html

http://evil.webblaze.org/jww/tests/location-test.html
  puts up an alert that says "undefined"

http://evil.webblaze.org/jww/tests/history-test.html
  puts up an alert that says "undefined"

0 files changed, 0 insertions, 0 deletions