apply essential security patches

bug:3341457
bug:3341449
Change-Id: I7ba58e63a6bcf992b76eb2f5557c26ff30e63ef6

1 files changed, 28 insertions, 5 deletions

diff --git a/WebCore/page/History.cpp b/WebCore/page/History.cpp
index 95b1350..f0a75fe 100644
--- a/WebCore/page/History.cpp
+++ b/WebCore/page/History.cpp
@@ -27,6 +27,7 @@
 #include "History.h"
 
 #include "BackForwardController.h"
+#include "Document.h"
 #include "ExceptionCode.h"
 #include "Frame.h"
 #include "FrameLoader.h"
@@ -62,22 +63,44 @@ unsigned History::length() const
 
 void History::back()
 {
-    if (!m_frame)
-        return;
-    m_frame->navigationScheduler()->scheduleHistoryNavigation(-1);
+    go(-1);
+}
+
+void History::back(ScriptExecutionContext* context)
+{
+    go(context, -1);
 }
 
 void History::forward()
 {
+    go(1);
+}
+
+void History::forward(ScriptExecutionContext* context)
+{
+    go(context, 1);
+}
+
+void History::go(int distance)
+{
     if (!m_frame)
         return;
-    m_frame->navigationScheduler()->scheduleHistoryNavigation(1);
+    m_frame->navigationScheduler()->scheduleHistoryNavigation(distance);
 }
 
-void History::go(int distance)
+void History::go(ScriptExecutionContext* context, int distance)
 {
     if (!m_frame)
         return;
+
+    ASSERT(WTF::isMainThread());
+    Frame* activeFrame = static_cast<Document*>(context)->frame();
+    if (!activeFrame)
+        return;
+
+    if (!activeFrame->loader()->shouldAllowNavigation(m_frame))
+        return;
+
     m_frame->navigationScheduler()->scheduleHistoryNavigation(distance);
 }