Attachment 340049 Details for Bug 184996 – Patch

[patch] Patch

bug-184996-20180509163339.patch (text/plain), 84.37 KB, created by Chris Dumez on 2018-05-09 16:33:40 PDT

(hide)

Description:

Filename:

MIME Type:

Creator: Chris Dumez

Created: 2018-05-09 16:33:40 PDT

Size: 84.37 KB

patch

obsolete

>Subversion Revision: 231589
>diff --git a/Source/WebCore/ChangeLog b/Source/WebCore/ChangeLog
>index a2325346dd5c82a6791c273887d5352e28895ab4..06337e0fa3a0bc53a5fdd037d265c758032f8b94 100644
>--- a/Source/WebCore/ChangeLog
>+++ b/Source/WebCore/ChangeLog
>@@ -1,3 +1,83 @@
>+2018-05-09  Chris Dumez  <cdumez@apple.com>
>+
>+        Add initial support for 'Cross-Origin-Options' HTTP response header
>+        https://bugs.webkit.org/show_bug.cgi?id=184996
>+        <rdar://problem/39664620>
>+
>+        Reviewed by Geoff Garen.
>+
>+        Add initial support for 'Cross-Origin-Options' HTTP response header behind an experimental
>+        feature flag, on by default. When the HTTP server services this HTTP response header for a
>+        main resource, we'll set these options on the corresponding Document. This will impact the
>+        behavior of the Document's associated Window API when cross-origin.
>+
>+        The HTTP header has 3 possible values:
>+        - allow: This is the default. Regular cross-origin Window API is available.
>+        - allow-postmessage: Only postMessage() is available on a cross-origin window, trying to
>+          access anything else will throw a SecurityError.
>+        - deny: Trying to do anything with a cross-origin window will throw a SecurityError.
>+
>+        The header has no effect when accessing same origin windows.
>+
>+        Note that on cross-origin access from Window A to Window B, we check the cross-origin
>+        options for both Window A and Window B and use the lowest common denominator as effective
>+        cross-origin options for the access. So if Window A has 'Cross-Origin-Options: deny' and
>+        tries to call postMessage() on Window B which has 'Cross-Origin-Options: allow-postmessage',
>+        we will throw a SecurityError. This is because Window A's more restrictive options (deny)
>+        apply.
>+
>+        Tests: http/wpt/cross-origin-options/allow-postmessage-from-deny.html
>+               http/wpt/cross-origin-options/allow-postmessage.html
>+               http/wpt/cross-origin-options/cross-origin-options-header.html
>+
>+        * bindings/js/JSDOMBindingSecurity.cpp:
>+        (WebCore::BindingSecurity::shouldAllowAccessToDOMWindowGivenMinimumCrossOriginOptions):
>+        * bindings/js/JSDOMBindingSecurity.h:
>+        * bindings/js/JSDOMWindowCustom.cpp:
>+        (WebCore::effectiveCrossOriginOptionsForAccess):
>+        (WebCore::jsDOMWindowGetOwnPropertySlotRestrictedAccess):
>+        (WebCore::JSDOMWindow::getOwnPropertySlot):
>+        (WebCore::JSDOMWindow::getOwnPropertySlotByIndex):
>+        (WebCore::addCrossOriginWindowPropertyNames):
>+        (WebCore::addScopedChildrenIndexes):
>+        (WebCore::addCrossOriginWindowOwnPropertyNames):
>+        (WebCore::JSDOMWindow::getOwnPropertyNames):
>+        * bindings/js/JSDOMWindowCustom.h:
>+        * bindings/js/JSRemoteDOMWindowCustom.cpp:
>+        (WebCore::JSRemoteDOMWindow::getOwnPropertySlot):
>+        (WebCore::JSRemoteDOMWindow::getOwnPropertySlotByIndex):
>+        (WebCore::JSRemoteDOMWindow::getOwnPropertyNames):
>+        * bindings/scripts/CodeGeneratorJS.pm:
>+        (GenerateAttributeGetterBodyDefinition):
>+        (GetCrossOriginsOptionsFromExtendedAttributeValue):
>+        (GenerateAttributeSetterBodyDefinition):
>+        (GenerateOperationBodyDefinition):
>+        * bindings/scripts/IDLAttributes.json:
>+        * dom/Document.cpp:
>+        (WebCore::Document::setCrossOriginOptions):
>+        * dom/Document.h:
>+        (WebCore::Document::crossOriginOptions const):
>+        * loader/FrameLoader.cpp:
>+        (WebCore::FrameLoader::didBeginDocument):
>+        * page/AbstractDOMWindow.cpp:
>+        (WebCore::AbstractDOMWindow::AbstractDOMWindow):
>+        * page/AbstractDOMWindow.h:
>+        (WebCore::AbstractDOMWindow::crossOriginOptions):
>+        (WebCore::AbstractDOMWindow::setCrossOriginOptions):
>+        * page/DOMWindow.cpp:
>+        (WebCore::DOMWindow::DOMWindow):
>+        (WebCore::DOMWindow::didSecureTransitionTo):
>+        * page/DOMWindow.idl:
>+        * page/Frame.h:
>+        * page/RemoteDOMWindow.cpp:
>+        (WebCore::RemoteDOMWindow::RemoteDOMWindow):
>+        * page/RemoteDOMWindow.h:
>+        * page/Settings.yaml:
>+        * platform/network/HTTPHeaderNames.in:
>+        * platform/network/HTTPParsers.cpp:
>+        (WebCore::parseCrossOriginOptionsHeader):
>+        * platform/network/HTTPParsers.h:
>+
> 2018-05-09  Youenn Fablet  <youenn@apple.com>
> 
>         Allow WebResourceLoader to cancel a load served from a service worker
>diff --git a/Source/WebKit/ChangeLog b/Source/WebKit/ChangeLog
>index be5b7f498538cc2182c0ebb1e33ea6f5341d0f21..1975daad6ba377bb547dc1881067a3386571c020 100644
>--- a/Source/WebKit/ChangeLog
>+++ b/Source/WebKit/ChangeLog
>@@ -1,3 +1,19 @@
>+2018-05-09  Chris Dumez  <cdumez@apple.com>
>+
>+        Add initial support for 'Cross-Origin-Options' HTTP response header
>+        https://bugs.webkit.org/show_bug.cgi?id=184996
>+        <rdar://problem/39664620>
>+
>+        Reviewed by Geoff Garen.
>+
>+        * Shared/WebPreferences.yaml:
>+        Add this as an experimental feature, on by default.
>+
>+        * WebProcess/WebPage/WebPage.cpp:
>+        (WebKit::WebPage::frameBecameRemote):
>+        Make sure we pass the cross-origin options from the local Window
>+        to the remote one when transitioning.
>+
> 2018-05-09  Youenn Fablet  <youenn@apple.com>
> 
>         Allow WebResourceLoader to cancel a load served from a service worker
>diff --git a/Source/WebCore/bindings/js/JSDOMBindingSecurity.cpp b/Source/WebCore/bindings/js/JSDOMBindingSecurity.cpp
>index e2816dbbf8830f164e946083c375a72ec8cf9aa6..2b6758511604146085c3b0f9ee1a0efbafa412a0 100644
>--- a/Source/WebCore/bindings/js/JSDOMBindingSecurity.cpp
>+++ b/Source/WebCore/bindings/js/JSDOMBindingSecurity.cpp
>@@ -25,6 +25,7 @@
> #include "DOMWindow.h"
> #include "Document.h"
> #include "Frame.h"
>+#include "HTTPParsers.h"
> #include "JSDOMExceptionHandling.h"
> #include "JSDOMWindowBase.h"
> #include "SecurityOrigin.h"
>@@ -99,4 +100,19 @@ bool BindingSecurity::shouldAllowAccessToNode(JSC::ExecState& state, Node* targe
>     return !target || canAccessDocument(&state, &target->document(), LogSecurityError);
> }
> 
>+bool BindingSecurity::shouldAllowAccessToDOMWindowGivenMinimumCrossOriginOptions(JSC::ExecState* state, DOMWindow& target, CrossOriginOptions minimumCrossOriginOptions, SecurityReportingOption reportingOption)
>+{
>+    DOMWindow& source = activeDOMWindow(*state);
>+    ASSERT(minimumCrossOriginOptions > CrossOriginOptions::Deny);
>+
>+    static_assert(CrossOriginOptions::Deny < CrossOriginOptions::AllowPostMessage && CrossOriginOptions::AllowPostMessage < CrossOriginOptions::Allow, "More restrictive cross-origin options should have lower values");
>+
>+    // Fast path.
>+    auto effectiveCrossOriginOptions = std::min(source.crossOriginOptions(), target.crossOriginOptions());
>+    if (effectiveCrossOriginOptions >= minimumCrossOriginOptions)
>+        return true;
>+
>+    return shouldAllowAccessToDOMWindow(state, target, reportingOption);
>+}
>+
> } // namespace WebCore
>diff --git a/Source/WebCore/bindings/js/JSDOMBindingSecurity.h b/Source/WebCore/bindings/js/JSDOMBindingSecurity.h
>index 7b4085a51ba9ddd3ed6a860c49659ae37507ee3e..5c2af998857f39d73cf7aa0a245735b96e454f15 100644
>--- a/Source/WebCore/bindings/js/JSDOMBindingSecurity.h
>+++ b/Source/WebCore/bindings/js/JSDOMBindingSecurity.h
>@@ -36,6 +36,8 @@ class DOMWindow;
> class Frame;
> class Node;
> 
>+enum class CrossOriginOptions;
>+
> void printErrorMessageForFrame(Frame*, const String& message);
> 
> enum SecurityReportingOption { DoNotReportSecurityError, LogSecurityError, ThrowSecurityError };
>@@ -53,6 +55,8 @@ bool shouldAllowAccessToFrame(JSC::ExecState*, Frame*, SecurityReportingOption =
> bool shouldAllowAccessToFrame(JSC::ExecState&, Frame&, String& message);
> bool shouldAllowAccessToNode(JSC::ExecState&, Node*);
> 
>+bool shouldAllowAccessToDOMWindowGivenMinimumCrossOriginOptions(JSC::ExecState*, DOMWindow&, CrossOriginOptions, SecurityReportingOption = LogSecurityError);
>+
> };
> 
> template<typename T> inline T* BindingSecurity::checkSecurityForNode(JSC::ExecState& state, T& node)
>diff --git a/Source/WebCore/bindings/js/JSDOMWindowCustom.cpp b/Source/WebCore/bindings/js/JSDOMWindowCustom.cpp
>index 281ea4e7004593eb6dea541c74b5bca4ae5dfa60..5db1d5ccbe1fe8b7fa29d39faadb38813beae8be 100644
>--- a/Source/WebCore/bindings/js/JSDOMWindowCustom.cpp
>+++ b/Source/WebCore/bindings/js/JSDOMWindowCustom.cpp
>@@ -26,6 +26,7 @@
> #include "HTMLCollection.h"
> #include "HTMLDocument.h"
> #include "HTMLFrameOwnerElement.h"
>+#include "HTTPParsers.h"
> #include "JSDOMBindingSecurity.h"
> #include "JSDOMConvertNullable.h"
> #include "JSDOMConvertNumbers.h"
>@@ -55,6 +56,12 @@
> namespace WebCore {
> using namespace JSC;
> 
>+static CrossOriginOptions effectiveCrossOriginOptionsForAccess(ExecState& state, AbstractDOMWindow& target)
>+{
>+    static_assert(CrossOriginOptions::Deny < CrossOriginOptions::AllowPostMessage && CrossOriginOptions::AllowPostMessage < CrossOriginOptions::Allow, "More restrictive cross-origin options should have lower values");
>+    return std::min(activeDOMWindow(state).crossOriginOptions(), target.crossOriginOptions());
>+}
>+
> EncodedJSValue JSC_HOST_CALL jsDOMWindowInstanceFunctionShowModalDialog(ExecState*);
> 
> void JSDOMWindow::visitAdditionalChildren(SlotVisitor& visitor)
>@@ -80,9 +87,9 @@ static EncodedJSValue jsDOMWindowWebKit(ExecState* exec, EncodedJSValue thisValu
> #endif
> 
> template <DOMWindowType windowType>
>-bool jsDOMWindowGetOwnPropertySlotRestrictedAccess(JSDOMGlobalObject* thisObject, AbstractFrame* frame, ExecState* exec, PropertyName propertyName, PropertySlot& slot, const String& errorMessage)
>+bool jsDOMWindowGetOwnPropertySlotRestrictedAccess(JSDOMGlobalObject* thisObject, AbstractDOMWindow& window, ExecState& state, PropertyName propertyName, PropertySlot& slot, const String& errorMessage)
> {
>-    VM& vm = exec->vm();
>+    VM& vm = state.vm();
>     auto scope = DECLARE_THROW_SCOPE(vm);
> 
>     auto& builtinNames = static_cast<JSVMClientData*>(vm.clientData)->builtinNames();
>@@ -93,6 +100,21 @@ bool jsDOMWindowGetOwnPropertySlotRestrictedAccess(JSDOMGlobalObject* thisObject
>         return true;
>     }
> 
>+    switch (effectiveCrossOriginOptionsForAccess(state, window)) {
>+    case CrossOriginOptions::AllowPostMessage:
>+        if (propertyName == builtinNames.postMessagePublicName()) {
>+            slot.setCustom(thisObject, static_cast<unsigned>(JSC::PropertyAttribute::ReadOnly | JSC::PropertyAttribute::DontEnum), windowType == DOMWindowType::Remote ? nonCachingStaticFunctionGetter<jsRemoteDOMWindowInstanceFunctionPostMessage, 0> : nonCachingStaticFunctionGetter<jsDOMWindowInstanceFunctionPostMessage, 2>);
>+            return true;
>+        }
>+        FALLTHROUGH;
>+    case CrossOriginOptions::Deny:
>+        throwSecurityError(state, scope, errorMessage);
>+        slot.setUndefined();
>+        return false;
>+    case CrossOriginOptions::Allow:
>+        break;
>+    }
>+
>     // These are the functions we allow access to cross-origin (DoNotCheckSecurity in IDL).
>     // Always provide the original function, on a fresh uncached function object.
>     if (propertyName == builtinNames.blurPublicName()) {
>@@ -136,7 +158,7 @@ bool jsDOMWindowGetOwnPropertySlotRestrictedAccess(JSDOMGlobalObject* thisObject
>         // For any other entries in the static property table, deny access. (Early return also prevents
>         // named getter from returning frames with matching names - this seems a little questionable, see
>         // FIXME comment on prototype search below.)
>-        throwSecurityError(*exec, scope, errorMessage);
>+        throwSecurityError(state, scope, errorMessage);
>         slot.setUndefined();
>         return false;
>     }
>@@ -146,19 +168,20 @@ bool jsDOMWindowGetOwnPropertySlotRestrictedAccess(JSDOMGlobalObject* thisObject
>     // properties that are in Moz but not IE. Since we have some of these, we have to do it
>     // the Moz way.
>     // FIXME: Add support to named attributes on RemoteFrames.
>+    auto* frame = window.frame();
>     if (frame && is<Frame>(*frame)) {
>         if (auto* scopedChild = downcast<Frame>(*frame).tree().scopedChild(propertyNameToAtomicString(propertyName))) {
>-            slot.setValue(thisObject, JSC::PropertyAttribute::ReadOnly | JSC::PropertyAttribute::DontDelete | JSC::PropertyAttribute::DontEnum, toJS(exec, scopedChild->document()->domWindow()));
>+            slot.setValue(thisObject, JSC::PropertyAttribute::ReadOnly | JSC::PropertyAttribute::DontDelete | JSC::PropertyAttribute::DontEnum, toJS(&state, scopedChild->document()->domWindow()));
>             return true;
>         }
>     }
> 
>-    throwSecurityError(*exec, scope, errorMessage);
>+    throwSecurityError(state, scope, errorMessage);
>     slot.setUndefined();
>     return false;
> }
>-template bool jsDOMWindowGetOwnPropertySlotRestrictedAccess<DOMWindowType::Local>(JSDOMGlobalObject*, AbstractFrame*, ExecState*, PropertyName, PropertySlot&, const String&);
>-template bool jsDOMWindowGetOwnPropertySlotRestrictedAccess<DOMWindowType::Remote>(JSDOMGlobalObject*, AbstractFrame*, ExecState*, PropertyName, PropertySlot&, const String&);
>+template bool jsDOMWindowGetOwnPropertySlotRestrictedAccess<DOMWindowType::Local>(JSDOMGlobalObject*, AbstractDOMWindow&, ExecState&, PropertyName, PropertySlot&, const String&);
>+template bool jsDOMWindowGetOwnPropertySlotRestrictedAccess<DOMWindowType::Remote>(JSDOMGlobalObject*, AbstractDOMWindow&, ExecState&, PropertyName, PropertySlot&, const String&);
> 
> // Property access sequence is:
> // (1) indexed properties,
>@@ -172,13 +195,12 @@ bool JSDOMWindow::getOwnPropertySlot(JSObject* object, ExecState* state, Propert
>         return getOwnPropertySlotByIndex(object, state, index.value(), slot);
> 
>     auto* thisObject = jsCast<JSDOMWindow*>(object);
>-    auto* frame = thisObject->wrapped().frame();
> 
>     // Hand off all cross-domain access to jsDOMWindowGetOwnPropertySlotRestrictedAccess.
>     String errorMessage;
>     if (!BindingSecurity::shouldAllowAccessToDOMWindow(*state, thisObject->wrapped(), errorMessage))
>-        return jsDOMWindowGetOwnPropertySlotRestrictedAccess<DOMWindowType::Local>(thisObject, frame, state, propertyName, slot, errorMessage);
>-    
>+        return jsDOMWindowGetOwnPropertySlotRestrictedAccess<DOMWindowType::Local>(thisObject, thisObject->wrapped(), *state, propertyName, slot, errorMessage);
>+
>     // FIXME: this need more explanation.
>     // (Particularly, is it correct that this exists here but not in getOwnPropertySlotByIndex?)
>     slot.setWatchpointSet(thisObject->m_windowCloseWatchpoints);
>@@ -186,6 +208,8 @@ bool JSDOMWindow::getOwnPropertySlot(JSObject* object, ExecState* state, Propert
>     // (2) Regular own properties.
>     PropertySlot slotCopy = slot;
>     if (Base::getOwnPropertySlot(thisObject, state, propertyName, slot)) {
>+        auto* frame = thisObject->wrapped().frame();
>+
>         // Detect when we're getting the property 'showModalDialog', this is disabled, and has its original value.
>         bool isShowModalDialogAndShouldHide = propertyName == static_cast<JSVMClientData*>(state->vm().clientData)->builtinNames().showModalDialogPublicName()
>             && (!frame || !DOMWindow::canShowModalDialog(*frame))
>@@ -213,22 +237,39 @@ bool JSDOMWindow::getOwnPropertySlot(JSObject* object, ExecState* state, Propert
> bool JSDOMWindow::getOwnPropertySlotByIndex(JSObject* object, ExecState* state, unsigned index, PropertySlot& slot)
> {
>     auto* thisObject = jsCast<JSDOMWindow*>(object);
>-    auto* frame = thisObject->wrapped().frame();
>+    auto& window = thisObject->wrapped();
>+    auto* frame = window.frame();
> 
>     // Indexed getters take precendence over regular properties, so caching would be invalid.
>     slot.disableCaching();
> 
>+    String errorMessage;
>+    std::optional<bool> cachedIsCrossOriginAccess;
>+    auto isCrossOriginAccess = [&] {
>+        if (!cachedIsCrossOriginAccess)
>+            cachedIsCrossOriginAccess = !BindingSecurity::shouldAllowAccessToDOMWindow(*state, window, errorMessage);
>+        return *cachedIsCrossOriginAccess;
>+    };
>+
>     // (1) First, indexed properties.
>-    // These are also allowed cross-orgin, so come before the access check.
>-    if (frame && index < frame->tree().scopedChildCount()) {
>-        slot.setValue(thisObject, static_cast<unsigned>(JSC::PropertyAttribute::ReadOnly), toJS(state, frame->tree().scopedChild(index)->document()->domWindow()));
>-        return true;
>+    // These are also allowed cross-origin, so come before the access check.
>+    switch (effectiveCrossOriginOptionsForAccess(*state, window)) {
>+    case CrossOriginOptions::Deny:
>+    case CrossOriginOptions::AllowPostMessage:
>+        if (isCrossOriginAccess())
>+            break;
>+        FALLTHROUGH;
>+    case CrossOriginOptions::Allow:
>+        if (frame && index < frame->tree().scopedChildCount()) {
>+            slot.setValue(thisObject, static_cast<unsigned>(JSC::PropertyAttribute::ReadOnly), toJS(state, frame->tree().scopedChild(index)->document()->domWindow()));
>+            return true;
>+        }
>+        break;
>     }
> 
>     // Hand off all cross-domain/frameless access to jsDOMWindowGetOwnPropertySlotRestrictedAccess.
>-    String errorMessage;
>-    if (!BindingSecurity::shouldAllowAccessToDOMWindow(*state, thisObject->wrapped(), errorMessage))
>-        return jsDOMWindowGetOwnPropertySlotRestrictedAccess<DOMWindowType::Local>(thisObject, frame, state, Identifier::from(state, index), slot, errorMessage);
>+    if (isCrossOriginAccess())
>+        return jsDOMWindowGetOwnPropertySlotRestrictedAccess<DOMWindowType::Local>(thisObject, window, *state, Identifier::from(state, index), slot, errorMessage);
> 
>     // (2) Regular own properties.
>     return Base::getOwnPropertySlotByIndex(thisObject, state, index, slot);
>@@ -287,8 +328,10 @@ bool JSDOMWindow::deletePropertyByIndex(JSCell* cell, ExecState* exec, unsigned
> }
> 
> // https://html.spec.whatwg.org/#crossoriginproperties-(-o-)
>-static void addCrossOriginWindowPropertyNames(VM& vm, PropertyNameArray& propertyNames)
>+static void addCrossOriginWindowPropertyNames(ExecState& state, AbstractDOMWindow& window, PropertyNameArray& propertyNames)
> {
>+    auto& vm = state.vm();
>+
>     static const Identifier* const properties[] = {
>         &static_cast<JSVMClientData*>(vm.clientData)->builtinNames().blurPublicName(),
>         &static_cast<JSVMClientData*>(vm.clientData)->builtinNames().closePublicName(),
>@@ -304,8 +347,18 @@ static void addCrossOriginWindowPropertyNames(VM& vm, PropertyNameArray& propert
>         &static_cast<JSVMClientData*>(vm.clientData)->builtinNames().topPublicName(),
>         &static_cast<JSVMClientData*>(vm.clientData)->builtinNames().windowPublicName()
>     };
>-    for (auto* property : properties)
>-        propertyNames.add(*property);
>+
>+    switch (effectiveCrossOriginOptionsForAccess(state, window)) {
>+    case CrossOriginOptions::Allow:
>+        for (auto* property : properties)
>+            propertyNames.add(*property);
>+        break;
>+    case CrossOriginOptions::AllowPostMessage:
>+        propertyNames.add(static_cast<JSVMClientData*>(vm.clientData)->builtinNames().postMessagePublicName());
>+        break;
>+    case CrossOriginOptions::Deny:
>+        break;
>+    }
> }
> 
> static void addScopedChildrenIndexes(ExecState& state, DOMWindow& window, PropertyNameArray& propertyNames)
>@@ -318,17 +371,25 @@ static void addScopedChildrenIndexes(ExecState& state, DOMWindow& window, Proper
>     if (!frame)
>         return;
> 
>+    switch (effectiveCrossOriginOptionsForAccess(state, window)) {
>+    case CrossOriginOptions::Allow:
>+        break;
>+    case CrossOriginOptions::Deny:
>+    case CrossOriginOptions::AllowPostMessage:
>+        return;
>+    }
>+
>     unsigned scopedChildCount = frame->tree().scopedChildCount();
>     for (unsigned i = 0; i < scopedChildCount; ++i)
>         propertyNames.add(Identifier::from(&state, i));
> }
> 
> // https://html.spec.whatwg.org/#crossoriginownpropertykeys-(-o-)
>-void addCrossOriginWindowOwnPropertyNames(ExecState& state, PropertyNameArray& propertyNames)
>+void addCrossOriginWindowOwnPropertyNames(ExecState& state, AbstractDOMWindow& window, PropertyNameArray& propertyNames)
> {
>-    VM& vm = state.vm();
>-    addCrossOriginWindowPropertyNames(vm, propertyNames);
>+    addCrossOriginWindowPropertyNames(state, window, propertyNames);
> 
>+    auto& vm = state.vm();
>     propertyNames.add(vm.propertyNames->toStringTagSymbol);
>     propertyNames.add(vm.propertyNames->hasInstanceSymbol);
>     propertyNames.add(vm.propertyNames->isConcatSpreadableSymbol);
>@@ -343,7 +404,7 @@ void JSDOMWindow::getOwnPropertyNames(JSObject* object, ExecState* exec, Propert
> 
>     if (!BindingSecurity::shouldAllowAccessToDOMWindow(exec, thisObject->wrapped(), DoNotReportSecurityError)) {
>         if (mode.includeDontEnumProperties())
>-            addCrossOriginWindowOwnPropertyNames(*exec, propertyNames);
>+            addCrossOriginWindowOwnPropertyNames(*exec, thisObject->wrapped(), propertyNames);
>         return;
>     }
>     Base::getOwnPropertyNames(thisObject, exec, propertyNames, mode);
>diff --git a/Source/WebCore/bindings/js/JSDOMWindowCustom.h b/Source/WebCore/bindings/js/JSDOMWindowCustom.h
>index cfda3e03866ba1aa3d7efa095bf8f0e4450c628c..9fe9742219480f705a13373d62cea5672cf64818 100644
>--- a/Source/WebCore/bindings/js/JSDOMWindowCustom.h
>+++ b/Source/WebCore/bindings/js/JSDOMWindowCustom.h
>@@ -22,6 +22,7 @@
> 
> namespace WebCore {
> 
>+class AbstractDOMWindow;
> class AbstractFrame;
> 
> inline JSDOMWindow* asJSDOMWindow(JSC::JSGlobalObject* globalObject)
>@@ -37,8 +38,8 @@ inline const JSDOMWindow* asJSDOMWindow(const JSC::JSGlobalObject* globalObject)
> enum class DOMWindowType { Local, Remote };
> 
> template <DOMWindowType windowType>
>-bool jsDOMWindowGetOwnPropertySlotRestrictedAccess(JSDOMGlobalObject*, AbstractFrame*, JSC::ExecState*, JSC::PropertyName, JSC::PropertySlot&, const String&);
>+bool jsDOMWindowGetOwnPropertySlotRestrictedAccess(JSDOMGlobalObject*, AbstractDOMWindow&, JSC::ExecState&, JSC::PropertyName, JSC::PropertySlot&, const String&);
> 
>-void addCrossOriginWindowOwnPropertyNames(JSC::ExecState&, JSC::PropertyNameArray&);
>+void addCrossOriginWindowOwnPropertyNames(JSC::ExecState&, AbstractDOMWindow&, JSC::PropertyNameArray&);
> 
> } // namespace WebCore
>diff --git a/Source/WebCore/bindings/js/JSRemoteDOMWindowCustom.cpp b/Source/WebCore/bindings/js/JSRemoteDOMWindowCustom.cpp
>index b7f7ae9851de986b5df2a5dd6e7c152fcee7c60a..8cd42526b9a6469b24dc9c3cd2a3ef4249964e33 100644
>--- a/Source/WebCore/bindings/js/JSRemoteDOMWindowCustom.cpp
>+++ b/Source/WebCore/bindings/js/JSRemoteDOMWindowCustom.cpp
>@@ -37,22 +37,19 @@ bool JSRemoteDOMWindow::getOwnPropertySlot(JSObject* object, ExecState* state, P
>         return getOwnPropertySlotByIndex(object, state, index.value(), slot);
> 
>     auto* thisObject = jsCast<JSRemoteDOMWindow*>(object);
>-    auto* frame = thisObject->wrapped().frame();
>-
>-    return jsDOMWindowGetOwnPropertySlotRestrictedAccess<DOMWindowType::Remote>(thisObject, frame, state, propertyName, slot, String());
>+    return jsDOMWindowGetOwnPropertySlotRestrictedAccess<DOMWindowType::Remote>(thisObject, thisObject->wrapped(), *state, propertyName, slot, String());
> }
> 
> bool JSRemoteDOMWindow::getOwnPropertySlotByIndex(JSObject* object, ExecState* state, unsigned index, PropertySlot& slot)
> {
>     auto* thisObject = jsCast<JSRemoteDOMWindow*>(object);
>-    auto* frame = thisObject->wrapped().frame();
> 
>     // Indexed getters take precendence over regular properties, so caching would be invalid.
>     slot.disableCaching();
> 
>     // FIXME: Add support for indexed properties.
> 
>-    return jsDOMWindowGetOwnPropertySlotRestrictedAccess<DOMWindowType::Remote>(thisObject, frame, state, Identifier::from(state, index), slot, String());
>+    return jsDOMWindowGetOwnPropertySlotRestrictedAccess<DOMWindowType::Remote>(thisObject, thisObject->wrapped(), *state, Identifier::from(state, index), slot, String());
> }
> 
> bool JSRemoteDOMWindow::put(JSCell* cell, ExecState* state, PropertyName propertyName, JSValue value, PutPropertySlot& slot)
>@@ -100,12 +97,14 @@ bool JSRemoteDOMWindow::deletePropertyByIndex(JSCell*, ExecState* state, unsigne
>     return false;
> }
> 
>-void JSRemoteDOMWindow::getOwnPropertyNames(JSObject*, ExecState* exec, PropertyNameArray& propertyNames, EnumerationMode mode)
>+void JSRemoteDOMWindow::getOwnPropertyNames(JSObject* object, ExecState* exec, PropertyNameArray& propertyNames, EnumerationMode mode)
> {
>+    auto* thisObject = jsCast<JSRemoteDOMWindow*>(object);
>+
>     // FIXME: Add scoped children indexes.
> 
>     if (mode.includeDontEnumProperties())
>-        addCrossOriginWindowOwnPropertyNames(*exec, propertyNames);
>+        addCrossOriginWindowOwnPropertyNames(*exec, thisObject->wrapped(), propertyNames);
> }
> 
> bool JSRemoteDOMWindow::defineOwnProperty(JSC::JSObject*, JSC::ExecState* state, JSC::PropertyName, const JSC::PropertyDescriptor&, bool)
>diff --git a/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm b/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm
>index 30a374c2824fa2608242aa38710984202b5d0ec0..b69c6dc9cbc8a5eb5cc9b2c7a2e8559ff1e216c5 100644
>--- a/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm
>+++ b/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm
>@@ -4706,7 +4706,13 @@ sub GenerateAttributeGetterBodyDefinition
>         !$attribute->extendedAttributes->{DoNotCheckSecurityOnGetter}) {
>         AddToImplIncludes("JSDOMBindingSecurity.h", $conditional);
>         if ($interface->type->name eq "DOMWindow") {
>-            push(@$outputArray, "    if (!BindingSecurity::shouldAllowAccessToDOMWindow(&state, thisObject.wrapped(), ThrowSecurityError))\n");
>+            if ($attribute->extendedAttributes->{DoNotCheckSecurityIf}) {
>+                my $crossOriginOptions = GetCrossOriginsOptionsFromExtendedAttributeValue($attribute->extendedAttributes->{DoNotCheckSecurityIf});
>+                AddToImplIncludes("HTTPParsers.h", $conditional);
>+                push(@$outputArray, "    if (!BindingSecurity::shouldAllowAccessToDOMWindowGivenMinimumCrossOriginOptions(&state, thisObject.wrapped(), $crossOriginOptions, ThrowSecurityError))\n");
>+            } else {
>+                push(@$outputArray, "    if (!BindingSecurity::shouldAllowAccessToDOMWindow(&state, thisObject.wrapped(), ThrowSecurityError))\n");
>+            }
>         } else {
>             push(@$outputArray, "    if (!BindingSecurity::shouldAllowAccessToFrame(&state, thisObject.wrapped().frame(), ThrowSecurityError))\n");
>         }
>@@ -4814,6 +4820,15 @@ sub GenerateAttributeGetterDefinition
>     push(@$outputArray, "#endif\n\n") if $conditional;
> }
> 
>+sub GetCrossOriginsOptionsFromExtendedAttributeValue
>+{
>+    my $extendedAttributeValue = shift;
>+
>+    return "CrossOriginOptions::Allow" if $extendedAttributeValue eq "CrossOriginOptionsAllow";
>+    return "CrossOriginOptions::AllowPostMessage" if $extendedAttributeValue eq "CrossOriginOptionsAllowPostMessage";
>+    die "Unsupported CrossOriginOptions: " + $extendedAttributeValue;
>+}
>+
> sub GenerateAttributeSetterBodyDefinition
> {
>     my ($outputArray, $interface, $className, $attribute, $attributeSetterBodyName, $conditional) = @_;
>@@ -4836,7 +4851,13 @@ sub GenerateAttributeSetterBodyDefinition
>     if ($interface->extendedAttributes->{CheckSecurity} && !$attribute->extendedAttributes->{DoNotCheckSecurity} && !$attribute->extendedAttributes->{DoNotCheckSecurityOnSetter}) {
>         AddToImplIncludes("JSDOMBindingSecurity.h", $conditional);
>         if ($interface->type->name eq "DOMWindow") {
>-            push(@$outputArray, "    if (!BindingSecurity::shouldAllowAccessToDOMWindow(&state, thisObject.wrapped(), ThrowSecurityError))\n");
>+            if ($attribute->extendedAttributes->{DoNotCheckSecurityIf}) {
>+                my $crossOriginOptions = GetCrossOriginsOptionsFromExtendedAttributeValue($attribute->extendedAttributes->{DoNotCheckSecurityIf});
>+                AddToImplIncludes("HTTPParsers.h", $conditional);
>+                push(@$outputArray, "    if (!BindingSecurity::shouldAllowAccessToDOMWindowGivenMinimumCrossOriginOptions(&state, thisObject.wrapped(), $crossOriginOptions, ThrowSecurityError))\n");
>+            } else {
>+                push(@$outputArray, "    if (!BindingSecurity::shouldAllowAccessToDOMWindow(&state, thisObject.wrapped(), ThrowSecurityError))\n");
>+            }
>         } else {
>             push(@$outputArray, "    if (!BindingSecurity::shouldAllowAccessToFrame(&state, thisObject.wrapped().frame(), ThrowSecurityError))\n");
>         }
>@@ -5057,7 +5078,13 @@ sub GenerateOperationBodyDefinition
>             
>             AddToImplIncludes("JSDOMBindingSecurity.h", $conditional);
>             if ($interface->type->name eq "DOMWindow") {
>-                push(@$outputArray, "    if (!BindingSecurity::shouldAllowAccessToDOMWindow(state, castedThis->wrapped(), ThrowSecurityError))\n");
>+                if ($operation->extendedAttributes->{DoNotCheckSecurityIf}) {
>+                    my $crossOriginOptions = GetCrossOriginsOptionsFromExtendedAttributeValue($operation->extendedAttributes->{DoNotCheckSecurityIf});
>+                    AddToImplIncludes("HTTPParsers.h", $conditional);
>+                    push(@$outputArray, "    if (!BindingSecurity::shouldAllowAccessToDOMWindowGivenMinimumCrossOriginOptions(state, castedThis->wrapped(), $crossOriginOptions, ThrowSecurityError))\n");
>+                } else {
>+                    push(@$outputArray, "    if (!BindingSecurity::shouldAllowAccessToDOMWindow(state, castedThis->wrapped(), ThrowSecurityError))\n");
>+                }
>                 push(@$outputArray, "        return JSValue::encode(jsUndefined());\n");
>             } else {
>                 push(@$outputArray, "    if (!BindingSecurity::shouldAllowAccessToFrame(state, castedThis->wrapped().frame(), ThrowSecurityError))\n");
>diff --git a/Source/WebCore/bindings/scripts/IDLAttributes.json b/Source/WebCore/bindings/scripts/IDLAttributes.json
>index c332b111efde3d24f39a4a5abac49ef65105fdfd..37d61e028ce2287f61cee9b2bc2900417c0a3739 100644
>--- a/Source/WebCore/bindings/scripts/IDLAttributes.json
>+++ b/Source/WebCore/bindings/scripts/IDLAttributes.json
>@@ -161,6 +161,10 @@
>         "DoNotCheckSecurity": {
>             "contextsAllowed": ["attribute", "operation"]
>         },
>+        "DoNotCheckSecurityIf": {
>+            "contextsAllowed": ["attribute", "operation"],
>+            "values": ["CrossOriginOptionsAllow", "CrossOriginOptionsAllowPostMessage"]
>+        },
>         "DoNotCheckSecurityOnGetter": {
>             "contextsAllowed": ["attribute"]
>         },
>diff --git a/Source/WebCore/dom/Document.cpp b/Source/WebCore/dom/Document.cpp
>index 95a3033408177ab8d2f4b3bd9bd5b7cac39aa12a..f8c3d9c7aad79ea73d70cb45173dba51cca40d9e 100644
>--- a/Source/WebCore/dom/Document.cpp
>+++ b/Source/WebCore/dom/Document.cpp
>@@ -517,6 +517,7 @@ Document::Document(Frame* frame, const URL& url, unsigned documentClasses, unsig
>     , m_didAssociateFormControlsTimer(*this, &Document::didAssociateFormControlsTimerFired)
>     , m_cookieCacheExpiryTimer(*this, &Document::invalidateDOMCookieCache)
>     , m_socketProvider(page() ? &page()->socketProvider() : nullptr)
>+    , m_crossOriginOptions { CrossOriginOptions::Allow }
>     , m_isSynthesized(constructionFlags & Synthesized)
>     , m_isNonRenderedPlaceholder(constructionFlags & NonRenderedPlaceholder)
>     , m_orientationNotifier(currentOrientation(frame))
>@@ -7806,4 +7807,11 @@ String Document::signedPublicKeyAndChallengeString(unsigned keySizeIndex, const
>     return page->chrome().client().signedPublicKeyAndChallengeString(keySizeIndex, challengeString, url);
> }
> 
>+void Document::setCrossOriginOptions(CrossOriginOptions value)
>+{
>+    m_crossOriginOptions = value;
>+    if (auto* window = domWindow())
>+        window->setCrossOriginOptions(value);
>+}
>+
> } // namespace WebCore
>diff --git a/Source/WebCore/dom/Document.h b/Source/WebCore/dom/Document.h
>index b9eff10963e4b428e0ed238c93c5babc541b9a58..6d7c525ee887ee6f65cbd5d6437202c015141d99 100644
>--- a/Source/WebCore/dom/Document.h
>+++ b/Source/WebCore/dom/Document.h
>@@ -194,6 +194,7 @@ class XPathResult;
> template<typename> class ExceptionOr;
> 
> enum CollectionType;
>+enum class CrossOriginOptions;
> enum class ShouldOpenExternalURLsPolicy;
> 
> enum class RouteSharingPolicy;
>@@ -1430,6 +1431,9 @@ public:
> 
>     String signedPublicKeyAndChallengeString(unsigned keySizeIndex, const String& challengeString, const URL&);
> 
>+    CrossOriginOptions crossOriginOptions() const { return m_crossOriginOptions; }
>+    void setCrossOriginOptions(CrossOriginOptions value);
>+
> protected:
>     enum ConstructionFlags { Synthesized = 1, NonRenderedPlaceholder = 1 << 1 };
>     Document(Frame*, const URL&, unsigned = DefaultDocumentClass, unsigned constructionFlags = 0);
>@@ -1815,6 +1819,8 @@ private:
> 
>     unsigned m_writeRecursionDepth { 0 };
> 
>+    CrossOriginOptions m_crossOriginOptions;
>+
>     InheritedBool m_designMode { inherit };
>     MediaProducer::MediaStateFlags m_mediaState { MediaProducer::IsNotPlaying };
>     bool m_userHasInteractedWithMediaElement { false };
>diff --git a/Source/WebCore/loader/FrameLoader.cpp b/Source/WebCore/loader/FrameLoader.cpp
>index 000b9a43cf7472c3ba417f4b2310ff90a3e240b3..729f25389c64690f08eb60d56215349e84881b53 100644
>--- a/Source/WebCore/loader/FrameLoader.cpp
>+++ b/Source/WebCore/loader/FrameLoader.cpp
>@@ -742,6 +742,12 @@ void FrameLoader::didBeginDocument(bool dispatch)
>             if (!headerContentLanguage.isEmpty())
>                 m_frame.document()->setContentLanguage(headerContentLanguage);
>         }
>+
>+        if (m_frame.settings().crossOriginOptionsSupportEnabled()) {
>+            String crossOriginOptionsHeader = m_documentLoader->response().httpHeaderField(HTTPHeaderName::CrossOriginOptions);
>+            if (!crossOriginOptionsHeader.isEmpty())
>+                m_frame.document()->setCrossOriginOptions(parseCrossOriginOptionsHeader(crossOriginOptionsHeader));
>+        }
>     }
> 
>     history().restoreDocumentState();
>diff --git a/Source/WebCore/page/AbstractDOMWindow.cpp b/Source/WebCore/page/AbstractDOMWindow.cpp
>index ba74519c1ee27db7577c3b673048d6ff56c403aa..582668f753deceafca5cbae3645a917c781081f9 100644
>--- a/Source/WebCore/page/AbstractDOMWindow.cpp
>+++ b/Source/WebCore/page/AbstractDOMWindow.cpp
>@@ -37,8 +37,9 @@ HashMap<GlobalWindowIdentifier, AbstractDOMWindow*>& AbstractDOMWindow::allWindo
>     return map;
> }
> 
>-AbstractDOMWindow::AbstractDOMWindow(GlobalWindowIdentifier&& identifier)
>+AbstractDOMWindow::AbstractDOMWindow(GlobalWindowIdentifier&& identifier, CrossOriginOptions crossOriginOptions)
>     : m_identifier(WTFMove(identifier))
>+    , m_crossOriginOptions(crossOriginOptions)
> {
>     ASSERT(!allWindows().contains(identifier));
>     allWindows().add(identifier, this);
>diff --git a/Source/WebCore/page/AbstractDOMWindow.h b/Source/WebCore/page/AbstractDOMWindow.h
>index 5a5debd532ad9a22e884bb66bc9dfab28ddbbca3..e26c2b78ae473d5a8fcf11e8e0c355ef899dbef2 100644
>--- a/Source/WebCore/page/AbstractDOMWindow.h
>+++ b/Source/WebCore/page/AbstractDOMWindow.h
>@@ -35,6 +35,8 @@ namespace WebCore {
> 
> class AbstractFrame;
> 
>+enum class CrossOriginOptions;
>+
> // FIXME: Rename DOMWindow to LocalWindow and AbstractDOMWindow to DOMWindow.
> class AbstractDOMWindow : public RefCounted<AbstractDOMWindow>, public EventTargetWithInlineData {
> public:
>@@ -52,8 +54,11 @@ public:
>     using RefCounted::ref;
>     using RefCounted::deref;
> 
>+    CrossOriginOptions crossOriginOptions() { return m_crossOriginOptions; }
>+    void setCrossOriginOptions(CrossOriginOptions value) { m_crossOriginOptions = value; }
>+
> protected:
>-    explicit AbstractDOMWindow(GlobalWindowIdentifier&&);
>+    AbstractDOMWindow(GlobalWindowIdentifier&&, CrossOriginOptions);
> 
>     EventTargetInterface eventTargetInterface() const final { return DOMWindowEventTargetInterfaceType; }
>     void refEventTarget() final { ref(); }
>@@ -61,6 +66,7 @@ protected:
> 
> private:
>     GlobalWindowIdentifier m_identifier;
>+    CrossOriginOptions m_crossOriginOptions;
> };
> 
> } // namespace WebCore
>diff --git a/Source/WebCore/page/DOMWindow.cpp b/Source/WebCore/page/DOMWindow.cpp
>index e402a99dd7bb4763f8ed30e976497fbd4fe44819..f4249d35c40b56a2850f4283cf81371892911990 100644
>--- a/Source/WebCore/page/DOMWindow.cpp
>+++ b/Source/WebCore/page/DOMWindow.cpp
>@@ -402,7 +402,7 @@ void DOMWindow::setCanShowModalDialogOverride(bool allow)
> }
> 
> DOMWindow::DOMWindow(Document& document)
>-    : AbstractDOMWindow(GlobalWindowIdentifier { Process::identifier(), generateObjectIdentifier<WindowIdentifierType>() })
>+    : AbstractDOMWindow(GlobalWindowIdentifier { Process::identifier(), generateObjectIdentifier<WindowIdentifierType>() }, document.crossOriginOptions())
>     , ContextDestructionObserver(&document)
>     , FrameDestructionObserver(document.frame())
> {
>@@ -413,6 +413,7 @@ DOMWindow::DOMWindow(Document& document)
> void DOMWindow::didSecureTransitionTo(Document& document)
> {
>     observeContext(&document);
>+    setCrossOriginOptions(document.crossOriginOptions());
> }
> 
> DOMWindow::~DOMWindow()
>diff --git a/Source/WebCore/page/DOMWindow.idl b/Source/WebCore/page/DOMWindow.idl
>index e696178eac677f55c9f2d32124c2e004ffdbda68..cd412e998c353967994966292a6e8f30abeba5ab 100644
>--- a/Source/WebCore/page/DOMWindow.idl
>+++ b/Source/WebCore/page/DOMWindow.idl
>@@ -49,11 +49,11 @@ typedef USVString CSSOMString;
>     PrimaryGlobal,
> ] interface DOMWindow : EventTarget {
>     // The current browsing context.
>-    [DoNotCheckSecurity, Unforgeable, ImplementedAs=self] readonly attribute WindowProxy window;
>-    [Replaceable, DoNotCheckSecurityOnGetter] readonly attribute WindowProxy self;
>+    [DoNotCheckSecurityIf=CrossOriginOptionsAllow, Unforgeable, ImplementedAs=self] readonly attribute WindowProxy window;
>+    [Replaceable, DoNotCheckSecurityIf=CrossOriginOptionsAllow] readonly attribute WindowProxy self;
>     [Unforgeable] readonly attribute Document document;
>     attribute DOMString name;
>-    [DoNotCheckSecurity, PutForwards=href, Unforgeable] readonly attribute Location? location; // FIXME: Should not be nullable.
>+    [DoNotCheckSecurityIf=CrossOriginOptionsAllow, PutForwards=href, Unforgeable] readonly attribute Location? location; // FIXME: Should not be nullable.
>     readonly attribute History history;
>     [EnabledAtRuntime=CustomElements, ImplementedAs=ensureCustomElementRegistry] readonly attribute CustomElementRegistry customElements;
>     [Replaceable] readonly attribute BarProp locationbar;
>@@ -63,18 +63,18 @@ typedef USVString CSSOMString;
>     [Replaceable] readonly attribute BarProp statusbar;
>     [Replaceable] readonly attribute BarProp toolbar;
>     attribute DOMString status;
>-    [DoNotCheckSecurity, CallWith=IncumbentDocument, ForwardDeclareInHeader] void close();
>-    [DoNotCheckSecurity, ForwardDeclareInHeader] readonly attribute boolean closed;
>+    [DoNotCheckSecurityIf=CrossOriginOptionsAllow, CallWith=IncumbentDocument, ForwardDeclareInHeader] void close();
>+    [DoNotCheckSecurityIf=CrossOriginOptionsAllow, ForwardDeclareInHeader] readonly attribute boolean closed;
>     void stop();
>-    [DoNotCheckSecurity, CallWith=IncumbentWindow, ForwardDeclareInHeader] void focus();
>-    [DoNotCheckSecurity, ForwardDeclareInHeader] void blur();
>+    [DoNotCheckSecurityIf=CrossOriginOptionsAllow, CallWith=IncumbentWindow, ForwardDeclareInHeader] void focus();
>+    [DoNotCheckSecurityIf=CrossOriginOptionsAllow, ForwardDeclareInHeader] void blur();
> 
>     // Other browsing contexts.
>-    [Replaceable, DoNotCheckSecurityOnGetter, ImplementedAs=self] readonly attribute WindowProxy frames;
>-    [Replaceable, DoNotCheckSecurityOnGetter] readonly attribute unsigned long length;
>-    [DoNotCheckSecurityOnGetter, Unforgeable] readonly attribute WindowProxy? top;
>-    [DoNotCheckSecurityOnGetter, CustomSetter] attribute WindowProxy? opener;
>-    [Replaceable, DoNotCheckSecurityOnGetter] readonly attribute WindowProxy? parent;
>+    [Replaceable, DoNotCheckSecurityIf=CrossOriginOptionsAllow, ImplementedAs=self] readonly attribute WindowProxy frames;
>+    [Replaceable, DoNotCheckSecurityIf=CrossOriginOptionsAllow] readonly attribute unsigned long length;
>+    [DoNotCheckSecurityIf=CrossOriginOptionsAllow, Unforgeable] readonly attribute WindowProxy? top;
>+    [DoNotCheckSecurityIf=CrossOriginOptionsAllow, CustomSetter] attribute WindowProxy? opener;
>+    [Replaceable, DoNotCheckSecurityIf=CrossOriginOptionsAllow] readonly attribute WindowProxy? parent;
>     [CheckSecurityForNode] readonly attribute Element? frameElement;
>     [CallWith=ActiveWindow&FirstWindow] WindowProxy? open(optional USVString url = "about:blank", optional DOMString target = "_blank", optional [TreatNullAs=EmptyString] DOMString features = "");
> 
>@@ -92,7 +92,7 @@ typedef USVString CSSOMString;
>     long requestAnimationFrame(RequestAnimationFrameCallback callback); // FIXME: Should return an unsigned long.
>     void cancelAnimationFrame(long handle); // FIXME: handle should be an unsigned long.
> 
>-    [CallWith=ScriptState&IncumbentWindow, DoNotCheckSecurity, ForwardDeclareInHeader, MayThrowException] void postMessage(any message, USVString targetOrigin, optional sequence<object> transfer = []);
>+    [CallWith=ScriptState&IncumbentWindow, DoNotCheckSecurityIf=CrossOriginOptionsAllowPostMessage, ForwardDeclareInHeader, MayThrowException] void postMessage(any message, USVString targetOrigin, optional sequence<object> transfer = []);
> 
>     // Obsolete members, still part of the HTML specification (https://html.spec.whatwg.org/#Window-partial).
>     void captureEvents(); // Not implemented. Also not in modern standards. Empty function may help compatibility with legacy content.
>diff --git a/Source/WebCore/page/Frame.h b/Source/WebCore/page/Frame.h
>index 156ed12333e13cf2302449afb85726c0793b5751..25a34f8a3ddc210d95d1b589fdd19062d948a0fc 100644
>--- a/Source/WebCore/page/Frame.h
>+++ b/Source/WebCore/page/Frame.h
>@@ -136,7 +136,7 @@ public:
> 
>     WEBCORE_EXPORT ~Frame();
> 
>-    DOMWindow* window() const;
>+    WEBCORE_EXPORT DOMWindow* window() const;
> 
>     void addDestructionObserver(FrameDestructionObserver*);
>     void removeDestructionObserver(FrameDestructionObserver*);
>diff --git a/Source/WebCore/page/RemoteDOMWindow.cpp b/Source/WebCore/page/RemoteDOMWindow.cpp
>index 92f77936dad59441b832d7a76259fd70315c2ac2..03a925dec62003b41575604e69485f82b069e5cd 100644
>--- a/Source/WebCore/page/RemoteDOMWindow.cpp
>+++ b/Source/WebCore/page/RemoteDOMWindow.cpp
>@@ -32,8 +32,8 @@
> 
> namespace WebCore {
> 
>-RemoteDOMWindow::RemoteDOMWindow(Ref<RemoteFrame>&& frame, GlobalWindowIdentifier&& identifier)
>-    : AbstractDOMWindow(WTFMove(identifier))
>+RemoteDOMWindow::RemoteDOMWindow(Ref<RemoteFrame>&& frame, GlobalWindowIdentifier&& identifier, CrossOriginOptions crossOriginOptions)
>+    : AbstractDOMWindow(WTFMove(identifier), crossOriginOptions)
>     , m_frame(WTFMove(frame))
> {
>     m_frame->setWindow(this);
>diff --git a/Source/WebCore/page/RemoteDOMWindow.h b/Source/WebCore/page/RemoteDOMWindow.h
>index cb8611c5d035c709bab483e473648b83ff87b4c0..ede2a75d17c0edb2bb7c69c2c2003d25d23112db 100644
>--- a/Source/WebCore/page/RemoteDOMWindow.h
>+++ b/Source/WebCore/page/RemoteDOMWindow.h
>@@ -44,9 +44,9 @@ class Location;
> 
> class RemoteDOMWindow final : public AbstractDOMWindow {
> public:
>-    static Ref<RemoteDOMWindow> create(Ref<RemoteFrame>&& frame, GlobalWindowIdentifier&& identifier)
>+    static Ref<RemoteDOMWindow> create(Ref<RemoteFrame>&& frame, GlobalWindowIdentifier&& identifier, CrossOriginOptions crossOriginOptions)
>     {
>-        return adoptRef(*new RemoteDOMWindow(WTFMove(frame), WTFMove(identifier)));
>+        return adoptRef(*new RemoteDOMWindow(WTFMove(frame), WTFMove(identifier), crossOriginOptions));
>     }
> 
>     ~RemoteDOMWindow() final;
>@@ -68,7 +68,7 @@ public:
>     void postMessage(JSC::ExecState&, DOMWindow& incumbentWindow, JSC::JSValue message, const String& targetOrigin, Vector<JSC::Strong<JSC::JSObject>>&&);
> 
> private:
>-    WEBCORE_EXPORT RemoteDOMWindow(Ref<RemoteFrame>&&, GlobalWindowIdentifier&&);
>+    WEBCORE_EXPORT RemoteDOMWindow(Ref<RemoteFrame>&&, GlobalWindowIdentifier&&, CrossOriginOptions);
> 
>     bool isRemoteDOMWindow() const final { return true; }
>     bool isLocalDOMWindow() const final { return false; }
>diff --git a/Source/WebCore/page/Settings.yaml b/Source/WebCore/page/Settings.yaml
>index 5a2ca70e7558e8768ed8d39bead100a4ec3fe1d2..a032340534f668b908e95afd4176a92723f550b0 100644
>--- a/Source/WebCore/page/Settings.yaml
>+++ b/Source/WebCore/page/Settings.yaml
>@@ -742,6 +742,9 @@ clientCoordinatesRelativeToLayoutViewport:
>   initial: false
>   onChange: setNeedsRecalcStyleInAllFrames
> 
>+crossOriginOptionsSupportEnabled:
>+  initial: true
>+
> accessibilityEventsEnabled:
>   initial: true
>   conditional: ACCESSIBILITY_EVENTS
>diff --git a/Source/WebCore/platform/network/HTTPHeaderNames.in b/Source/WebCore/platform/network/HTTPHeaderNames.in
>index 3e192856e9e2e3d0d8d5b42d5d8260624b859c55..9d2b396c56ebfcb52bc343f73d3d6bd72c6ffdc7 100644
>--- a/Source/WebCore/platform/network/HTTPHeaderNames.in
>+++ b/Source/WebCore/platform/network/HTTPHeaderNames.in
>@@ -50,6 +50,7 @@ Content-Type
> Content-Range
> Cookie
> Cookie2
>+Cross-Origin-Options
> Date
> DNT
> Default-Style
>diff --git a/Source/WebCore/platform/network/HTTPParsers.cpp b/Source/WebCore/platform/network/HTTPParsers.cpp
>index c8f45e5aed19e9f0c6a68858a62ea8c758b38804..cf1432204e69feb64c604a695ed2994b79221783 100644
>--- a/Source/WebCore/platform/network/HTTPParsers.cpp
>+++ b/Source/WebCore/platform/network/HTTPParsers.cpp
>@@ -913,4 +913,19 @@ FromOriginDisposition parseFromOriginHeader(const String& header)
>     return FromOriginDisposition::Invalid;
> }
> 
>+CrossOriginOptions parseCrossOriginOptionsHeader(StringView header)
>+{
>+    auto strippedHeader = stripLeadingAndTrailingHTTPSpaces(header);
>+    if (strippedHeader.isEmpty())
>+        return CrossOriginOptions::Allow;
>+
>+    if (equalLettersIgnoringASCIICase(strippedHeader, "deny"))
>+        return CrossOriginOptions::Deny;
>+
>+    if (equalLettersIgnoringASCIICase(strippedHeader, "allow-postmessage"))
>+        return CrossOriginOptions::AllowPostMessage;
>+
>+    return CrossOriginOptions::Allow;
>+}
>+
> }
>diff --git a/Source/WebCore/platform/network/HTTPParsers.h b/Source/WebCore/platform/network/HTTPParsers.h
>index e14fc040c69e42759259266d4695132b25ea6f0a..4bb4a73843510fbaff99aae9e1f0d354a23523c1 100644
>--- a/Source/WebCore/platform/network/HTTPParsers.h
>+++ b/Source/WebCore/platform/network/HTTPParsers.h
>@@ -71,6 +71,13 @@ enum class FromOriginDisposition {
>     Invalid
> };
> 
>+// Should be sorted from most restrictive to most permissive.
>+enum class CrossOriginOptions {
>+    Deny,
>+    AllowPostMessage,
>+    Allow,
>+};
>+
> bool isValidReasonPhrase(const String&);
> bool isValidHTTPHeaderValue(const String&);
> bool isValidAcceptHeaderValue(const String&);
>@@ -111,6 +118,7 @@ bool isCrossOriginSafeRequestHeader(HTTPHeaderName, const String&);
> String normalizeHTTPMethod(const String&);
> 
> WEBCORE_EXPORT FromOriginDisposition parseFromOriginHeader(const String&);
>+CrossOriginOptions parseCrossOriginOptionsHeader(StringView);
> 
> inline bool isHTTPSpace(UChar character)
> {
>diff --git a/Source/WebKit/Shared/WebPreferences.yaml b/Source/WebKit/Shared/WebPreferences.yaml
>index 3189575a8d78d04e6c86d4414a63c5b6d2b376bb..cc6b49895ea83f5140297bcb1ff2daa6f4dd1cc5 100644
>--- a/Source/WebKit/Shared/WebPreferences.yaml
>+++ b/Source/WebKit/Shared/WebPreferences.yaml
>@@ -1097,6 +1097,13 @@ ConstantPropertiesEnabled:
>   humanReadableDescription: "Enable CSS constant() values"
>   category: experimental
> 
>+CrossOriginOptionsSupportEnabled:
>+  type: bool
>+  defaultValue: true
>+  humanReadableName: "Cross-Origin-Options HTTP Header"
>+  humanReadableDescription: "Enable support for Cross-Origin-Options HTTP Header"
>+  category: experimental
>+
> SpringTimingFunctionEnabled:
>   type: bool
>   defaultValue: DEFAULT_EXPERIMENTAL_FEATURES_ENABLED
>diff --git a/Source/WebKit/WebProcess/WebPage/WebPage.cpp b/Source/WebKit/WebProcess/WebPage/WebPage.cpp
>index fdd2056c2dba860b341af1ed1bf7633814f21ed2..f5d55ef9f591586b80c53ae17de2caab183ed3d9 100644
>--- a/Source/WebKit/WebProcess/WebPage/WebPage.cpp
>+++ b/Source/WebKit/WebProcess/WebPage/WebPage.cpp
>@@ -5905,8 +5905,13 @@ void WebPage::frameBecameRemote(uint64_t frameID, GlobalFrameIdentifier&& remote
>     if (frame->page() != this)
>         return;
> 
>+    auto* coreFrame = frame->coreFrame();
>+    auto* previousWindow = coreFrame->window();
>+    if (!previousWindow)
>+        return;
>+
>     auto remoteFrame = RemoteFrame::create(WTFMove(remoteFrameIdentifier));
>-    auto remoteWindow = RemoteDOMWindow::create(remoteFrame.copyRef(), WTFMove(remoteWindowIdentifier));
>+    auto remoteWindow = RemoteDOMWindow::create(remoteFrame.copyRef(), WTFMove(remoteWindowIdentifier), previousWindow->crossOriginOptions());
>     UNUSED_PARAM(remoteWindow);
> 
>     remoteFrame->setOpener(frame->coreFrame()->loader().opener());
>@@ -5915,7 +5920,6 @@ void WebPage::frameBecameRemote(uint64_t frameID, GlobalFrameIdentifier&& remote
>     remoteFrame->windowProxy().setJSWindowProxies(WTFMove(jsWindowProxies));
>     remoteFrame->windowProxy().setDOMWindow(remoteWindow.ptr());
> 
>-    auto* coreFrame = frame->coreFrame();
>     coreFrame->setView(nullptr);
>     coreFrame->willDetachPage();
>     coreFrame->detachFromPage();
>diff --git a/Source/WebKitLegacy/mac/WebView/WebPreferenceKeysPrivate.h b/Source/WebKitLegacy/mac/WebView/WebPreferenceKeysPrivate.h
>index 5cc4a2b7def1b804294cc1355b224e59d7ba749e..71185d2b21db676fff3fae573e56dad0a34f8456 100644
>--- a/Source/WebKitLegacy/mac/WebView/WebPreferenceKeysPrivate.h
>+++ b/Source/WebKitLegacy/mac/WebView/WebPreferenceKeysPrivate.h
>@@ -173,6 +173,7 @@
> #define WebKitDataTransferItemsEnabledPreferenceKey @"WebKitDataTransferItemsEnabled"
> #define WebKitCustomPasteboardDataEnabledPreferenceKey @"WebKitCustomPasteboardDataEnabled"
> #define WebKitCacheAPIEnabledPreferenceKey @"WebKitCacheAPIEnabled"
>+#define WebKitCrossOriginOptionsSupportEnabledPreferenceKey @"WebKitCrossOriginOptionsSupportEnabled"
> #define WebKitFetchAPIEnabledPreferenceKey @"WebKitFetchAPIEnabled"
> #define WebKitWritableStreamAPIEnabledPreferenceKey @"WebKitWritableStreamAPIEnabled"
> #define WebKitReadableByteStreamAPIEnabledPreferenceKey @"WebKitReadableByteStreamAPIEnabled"
>diff --git a/Source/WebKitLegacy/mac/WebView/WebPreferences.mm b/Source/WebKitLegacy/mac/WebView/WebPreferences.mm
>index 6858597adf9a2cefe5bf245281569c2cf21bf62d..a16022a4a29f1b28eceb94043b9e0a3f71a36244 100644
>--- a/Source/WebKitLegacy/mac/WebView/WebPreferences.mm
>+++ b/Source/WebKitLegacy/mac/WebView/WebPreferences.mm
>@@ -634,6 +634,7 @@ public:
>         [NSNumber numberWithBool:NO], WebKitWebGPUEnabledPreferenceKey,
> #endif
>         [NSNumber numberWithBool:NO], WebKitCacheAPIEnabledPreferenceKey,
>+        [NSNumber numberWithBool:NO], WebKitCrossOriginOptionsSupportEnabledPreferenceKey,
>         [NSNumber numberWithBool:YES], WebKitFetchAPIEnabledPreferenceKey,
> 
> #if ENABLE(STREAMS_API)
>@@ -3009,6 +3010,16 @@ static NSString *classIBCreatorID = nil;
>     [self _setBoolValue:flag forKey:WebKitCacheAPIEnabledPreferenceKey];
> }
> 
>+- (BOOL)crossOriginOptionsSupportEnabled
>+{
>+    return [self _boolValueForKey:WebKitCrossOriginOptionsSupportEnabledPreferenceKey];
>+}
>+
>+- (void)setCrossOriginOptionsSupportEnabled:(BOOL)flag
>+{
>+    [self _setBoolValue:flag forKey:WebKitCrossOriginOptionsSupportEnabledPreferenceKey];
>+}
>+
> - (BOOL)fetchAPIEnabled
> {
>     return [self _boolValueForKey:WebKitFetchAPIEnabledPreferenceKey];
>diff --git a/Source/WebKitLegacy/mac/WebView/WebPreferencesPrivate.h b/Source/WebKitLegacy/mac/WebView/WebPreferencesPrivate.h
>index fdaba840ec8db1f6925748c76510e1322257c200..c90ce4636ceb4fe833292fafd8bb9262d3987dab 100644
>--- a/Source/WebKitLegacy/mac/WebView/WebPreferencesPrivate.h
>+++ b/Source/WebKitLegacy/mac/WebView/WebPreferencesPrivate.h
>@@ -543,6 +543,9 @@ extern NSString *WebPreferencesCacheModelChangedInternalNotification WEBKIT_DEPR
> - (BOOL)cacheAPIEnabled;
> - (void)setCacheAPIEnabled:(BOOL)enabled;
> 
>+- (BOOL)crossOriginOptionsSupportEnabled;
>+- (void)setCrossOriginOptionsSupportEnabled:(BOOL)enabled;
>+
> - (void)setFetchAPIEnabled:(BOOL)flag;
> - (BOOL)fetchAPIEnabled;
> 
>diff --git a/Source/WebKitLegacy/mac/WebView/WebView.mm b/Source/WebKitLegacy/mac/WebView/WebView.mm
>index fefadfc81a6c1e31ff9fcdb51164492145f5b3b9..335641de237ccfe0ed0eb6c57cd59755ea6ea48e 100644
>--- a/Source/WebKitLegacy/mac/WebView/WebView.mm
>+++ b/Source/WebKitLegacy/mac/WebView/WebView.mm
>@@ -3062,6 +3062,7 @@ static bool needsSelfRetainWhileLoadingQuirk()
>     settings.setViewportFitEnabled([preferences viewportFitEnabled]);
>     settings.setConstantPropertiesEnabled([preferences constantPropertiesEnabled]);
>     settings.setColorFilterEnabled([preferences colorFilterEnabled]);
>+    settings.setCrossOriginOptionsSupportEnabled([preferences crossOriginOptionsSupportEnabled]);
> 
> #if ENABLE(GAMEPAD)
>     RuntimeEnabledFeatures::sharedFeatures().setGamepadsEnabled([preferences gamepadsEnabled]);
>diff --git a/Source/WebKitLegacy/win/Interfaces/IWebPreferencesPrivate.idl b/Source/WebKitLegacy/win/Interfaces/IWebPreferencesPrivate.idl
>index 891a7d0fa8f729649c8047fc600888f3a2d79146..f33b4715792b159b70d4e98c75b73a51746c752f 100644
>--- a/Source/WebKitLegacy/win/Interfaces/IWebPreferencesPrivate.idl
>+++ b/Source/WebKitLegacy/win/Interfaces/IWebPreferencesPrivate.idl
>@@ -228,3 +228,10 @@ interface IWebPreferencesPrivate6 : IWebPreferencesPrivate5
>     HRESULT menuItemElementEnabled([out, retval] BOOL* enabled);
>     HRESULT setMenuItemElementEnabled([in] BOOL enabled);
> }
>+
>+[uuid(9A49D1DE-53DD-11E8-95E6-003EE1C28AB6)]
>+interface IWebPreferencesPrivate7 : IWebPreferencesPrivate6
>+{
>+    HRESULT crossOriginOptionsSupportEnabled([out, retval] BOOL* enabled);
>+    HRESULT setCrossOriginOptionsSupportEnabled([in] BOOL enabled);
>+}
>diff --git a/Source/WebKitLegacy/win/WebPreferenceKeysPrivate.h b/Source/WebKitLegacy/win/WebPreferenceKeysPrivate.h
>index 37d73e6dfd4a89ec10ef4bb64cdad81a77546f68..872b647e5f9e2f46fe684c705c1c063994c22087 100644
>--- a/Source/WebKitLegacy/win/WebPreferenceKeysPrivate.h
>+++ b/Source/WebKitLegacy/win/WebPreferenceKeysPrivate.h
>@@ -180,6 +180,8 @@
> 
> #define WebKitMenuItemElementEnabledPreferenceKey "WebKitMenuItemElementEnabled"
> 
>+#define WebKitCrossOriginOptionsSupportEnabledPreferenceKey "WebKitCrossOriginOptionsSupportEnabled"
>+
> #define WebKitModernMediaControlsEnabledPreferenceKey "WebKitModernMediaControlsEnabled"
> 
> #define WebKitWebAnimationsEnabledPreferenceKey "WebKitWebAnimationsEnabled"
>diff --git a/Source/WebKitLegacy/win/WebPreferences.cpp b/Source/WebKitLegacy/win/WebPreferences.cpp
>index e460d13d3cbb553c79299cbd0e8f9432e09c61b5..b78c37aa9f5e754fd2b931ea5c4e4122d3630352 100644
>--- a/Source/WebKitLegacy/win/WebPreferences.cpp
>+++ b/Source/WebKitLegacy/win/WebPreferences.cpp
>@@ -249,6 +249,7 @@ void WebPreferences::initializeDefaultSettings()
>     CFDictionaryAddValue(defaults, CFSTR(WebKitShouldDisplaySubtitlesPreferenceKey), kCFBooleanFalse);
>     CFDictionaryAddValue(defaults, CFSTR(WebKitShouldDisplayCaptionsPreferenceKey), kCFBooleanFalse);
>     CFDictionaryAddValue(defaults, CFSTR(WebKitShouldDisplayTextDescriptionsPreferenceKey), kCFBooleanFalse);
>+    CFDictionaryAddValue(defaults, CFSTR(WebKitCrossOriginOptionsSupportEnabledPreferenceKey), kCFBooleanFalse);
> 
>     RetainPtr<CFStringRef> linkBehaviorStringRef = adoptCF(CFStringCreateWithFormat(0, 0, CFSTR("%d"), WebKitEditableLinkDefaultBehavior));
>     CFDictionaryAddValue(defaults, CFSTR(WebKitEditableLinkBehaviorPreferenceKey), linkBehaviorStringRef.get());
>@@ -2029,6 +2030,20 @@ HRESULT WebPreferences::setMenuItemElementEnabled(BOOL enabled)
>     return S_OK;
> }
> 
>+HRESULT WebPreferences::crossOriginOptionsSupportEnabled(_Out_ BOOL* enabled)
>+{
>+    if (!enabled)
>+        return E_POINTER;
>+    *enabled = boolValueForKey(WebKitCrossOriginOptionsSupportEnabledPreferenceKey);
>+    return S_OK;
>+}
>+
>+HRESULT WebPreferences::setCrossOriginOptionsSupportEnabled(BOOL enabled)
>+{
>+    setBoolValue(WebKitCrossOriginOptionsSupportEnabledPreferenceKey, enabled);
>+    return S_OK;
>+}
>+
> HRESULT WebPreferences::setModernMediaControlsEnabled(BOOL enabled)
> {
>     setBoolValue(WebKitModernMediaControlsEnabledPreferenceKey, enabled);
>diff --git a/Source/WebKitLegacy/win/WebPreferences.h b/Source/WebKitLegacy/win/WebPreferences.h
>index ddd8dcca9d2f9510f97d6a3fba18226c906359fc..fc3782a73003c99cc09d3310609a19ccd2338aa2 100644
>--- a/Source/WebKitLegacy/win/WebPreferences.h
>+++ b/Source/WebKitLegacy/win/WebPreferences.h
>@@ -276,6 +276,10 @@ public:
>     virtual HRESULT STDMETHODCALLTYPE menuItemElementEnabled(_Out_ BOOL*);
>     virtual HRESULT STDMETHODCALLTYPE setMenuItemElementEnabled(BOOL);
> 
>+    // IWebPreferencesPrivate7
>+    virtual HRESULT STDMETHODCALLTYPE crossOriginOptionsSupportEnabled(_Out_ BOOL*);
>+    virtual HRESULT STDMETHODCALLTYPE setCrossOriginOptionsSupportEnabled(BOOL);
>+
>     // WebPreferences
> 
>     // This method accesses a different preference key than developerExtrasEnabled.
>diff --git a/Source/WebKitLegacy/win/WebView.cpp b/Source/WebKitLegacy/win/WebView.cpp
>index d81c831fe2eb75675564da493f44070d7ef1a3d4..64de9ee752c5a386b160e2550db5b2f28e1d675f 100644
>--- a/Source/WebKitLegacy/win/WebView.cpp
>+++ b/Source/WebKitLegacy/win/WebView.cpp
>@@ -5150,7 +5150,7 @@ HRESULT WebView::notifyPreferencesChanged(IWebNotification* notification)
>     settings.setShouldDisplayTextDescriptions(enabled);
> #endif
> 
>-    COMPtr<IWebPreferencesPrivate6> prefsPrivate { Query, preferences };
>+    COMPtr<IWebPreferencesPrivate7> prefsPrivate { Query, preferences };
>     if (prefsPrivate) {
>         hr = prefsPrivate->localStorageDatabasePath(&str);
>         if (FAILED(hr))
>@@ -5279,6 +5279,11 @@ HRESULT WebView::notifyPreferencesChanged(IWebNotification* notification)
>         return hr;
>     settings.setVisualViewportAPIEnabled(!!enabled);
> 
>+    hr = prefsPrivate->crossOriginOptionsSupportEnabled(&enabled);
>+    if (FAILED(hr))
>+        return hr;
>+    settings.setCrossOriginOptionsSupportEnabled(!!enabled);
>+
>     hr = preferences->privateBrowsingEnabled(&enabled);
>     if (FAILED(hr))
>         return hr;
>diff --git a/Tools/DumpRenderTree/mac/DumpRenderTree.mm b/Tools/DumpRenderTree/mac/DumpRenderTree.mm
>index 5ac28d2f7045149fde99113b97572225309c9113..73d578654461f90d280aa61edac8b8a29f27102a 100644
>--- a/Tools/DumpRenderTree/mac/DumpRenderTree.mm
>+++ b/Tools/DumpRenderTree/mac/DumpRenderTree.mm
>@@ -862,6 +862,7 @@ static void enableExperimentalFeatures(WebPreferences* preferences)
>     [preferences setAccessibilityObjectModelEnabled:YES];
>     [preferences setVisualViewportAPIEnabled:YES];
>     [preferences setColorFilterEnabled:YES];
>+    [preferences setCrossOriginOptionsSupportEnabled:YES];
> }
> 
> // Called before each test.
>diff --git a/Tools/DumpRenderTree/win/DumpRenderTree.cpp b/Tools/DumpRenderTree/win/DumpRenderTree.cpp
>index ac6519f412c244a04f99268da6b40d887ac83722..cdc6d2313beaf84d2d090b0eb9bad556243ef160 100644
>--- a/Tools/DumpRenderTree/win/DumpRenderTree.cpp
>+++ b/Tools/DumpRenderTree/win/DumpRenderTree.cpp
>@@ -788,6 +788,7 @@ static void enableExperimentalFeatures(IWebPreferences* preferences)
>     prefsPrivate->setWebAnimationsEnabled(TRUE);
>     // FIXME: WebGL2
>     // FIXME: WebRTC
>+    prefsPrivate->setCrossOriginOptionsSupportEnabled(TRUE);
> }
> 
> static void resetWebPreferencesToConsistentValues(IWebPreferences* preferences)
>diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
>index ec35bc678654ab83568fafef362220cf49e5c1e7..bd83c439287622e6ef506c0fe820a8e57efcecf1 100644
>--- a/LayoutTests/ChangeLog
>+++ b/LayoutTests/ChangeLog
>@@ -1,3 +1,24 @@
>+2018-05-09  Chris Dumez  <cdumez@apple.com>
>+
>+        Add initial support for 'Cross-Origin-Options' HTTP response header
>+        https://bugs.webkit.org/show_bug.cgi?id=184996
>+        <rdar://problem/39664620>
>+
>+        Reviewed by Geoff Garen.
>+
>+        Add layout test coverage.
>+
>+        * http/wpt/cross-origin-options/allow-postmessage-expected.txt: Added.
>+        * http/wpt/cross-origin-options/allow-postmessage-from-deny-expected.txt: Added.
>+        * http/wpt/cross-origin-options/allow-postmessage-from-deny.html: Added.
>+        * http/wpt/cross-origin-options/allow-postmessage-from-deny.html.headers: Added.
>+        * http/wpt/cross-origin-options/allow-postmessage.html: Added.
>+        * http/wpt/cross-origin-options/cross-origin-options-header-expected.txt: Added.
>+        * http/wpt/cross-origin-options/cross-origin-options-header.html: Added.
>+        * http/wpt/cross-origin-options/resources/cross-origin-options-allow-postmessage-pong.html: Added.
>+        * http/wpt/cross-origin-options/resources/cross-origin-options-allow-postmessage-pong.html.headers: Added.
>+        * http/wpt/cross-origin-options/resources/serve-cross-origin-options-header.py: Added.
>+
> 2018-05-09  Youenn Fablet  <youenn@apple.com>
> 
>         Unflake some additional AppCache tests
>diff --git a/LayoutTests/http/wpt/cross-origin-options/allow-postmessage-expected.txt b/LayoutTests/http/wpt/cross-origin-options/allow-postmessage-expected.txt
>new file mode 100644
>index 0000000000000000000000000000000000000000..0e9998789a63bac7981b9ab67f9a62af248593eb
>--- /dev/null
>+++ b/LayoutTests/http/wpt/cross-origin-options/allow-postmessage-expected.txt
>@@ -0,0 +1,5 @@
>+
>+
>+PASS postMessage() on Cross-origin iframe with 'Cross-Origin-Options: allow-postmessage' HTTP header 
>+PASS postMessage() on Cross-origin popup with 'Cross-Origin-Options: allow-postmessage' HTTP header 
>+
>diff --git a/LayoutTests/http/wpt/cross-origin-options/allow-postmessage-from-deny-expected.txt b/LayoutTests/http/wpt/cross-origin-options/allow-postmessage-from-deny-expected.txt
>new file mode 100644
>index 0000000000000000000000000000000000000000..49f6c93d1d47fa77ff99b5940605f56ac1527c8e
>--- /dev/null
>+++ b/LayoutTests/http/wpt/cross-origin-options/allow-postmessage-from-deny-expected.txt
>@@ -0,0 +1,5 @@
>+
>+
>+PASS postMessage() on Cross-origin iframe with 'Cross-Origin-Options: allow-postmessage' but current window has 'deny' option 
>+PASS postMessage() on Cross-origin popup with 'Cross-Origin-Options: allow-postmessage' but current window has 'deny' option 
>+
>diff --git a/LayoutTests/http/wpt/cross-origin-options/allow-postmessage-from-deny.html b/LayoutTests/http/wpt/cross-origin-options/allow-postmessage-from-deny.html
>new file mode 100644
>index 0000000000000000000000000000000000000000..3494f0a27d0687d6653a03a8d1a964db8fd2b926
>--- /dev/null
>+++ b/LayoutTests/http/wpt/cross-origin-options/allow-postmessage-from-deny.html
>@@ -0,0 +1,31 @@
>+<!DOCTYPE html>
>+<html>
>+<head>
>+<meta charset="utf-8">
>+<title>Tests calling postMessage() on a window with 'Cross-Origin-Options: allow-postmessage' from a window with 'Cross-Origin-Options: deny'</title>
>+<script src="/resources/testharness.js"></script>
>+<script src="/resources/testharnessreport.js"></script>
>+<script src="/common/utils.js"></script>
>+<script src="/common/get-host-info.sub.js"></script>
>+<script src="resources/utils.js"></script>
>+</head>
>+<body>
>+<script>
>+
>+promise_test(function(test) {
>+    return withIframe("cross-origin-options-allow-postmessage-pong.html", true /* isCrossOrigin */).then((f) => {
>+        assert_throws("SecurityError", function() { f.contentWindow.length }, "length property access");
>+        assert_throws("SecurityError", function() { f.contentWindow.postMessage("PING", "*"); }, "Calling postMessage() should throw");
>+    });
>+}, "postMessage() on Cross-origin iframe with 'Cross-Origin-Options: allow-postmessage' but current window has 'deny' option");
>+
>+promise_test(function(test) {
>+    return withPopup("cross-origin-options-allow-postmessage-pong.html", true /* isCrossOrigin */).then((result) => {
>+        assert_throws("SecurityError", function() { result.window.length }, "length property access");
>+        assert_throws("SecurityError", function() { result.window.postMessage("PING", "*"); }, "Calling postMessage() should throw");
>+    });
>+}, "postMessage() on Cross-origin popup with 'Cross-Origin-Options: allow-postmessage' but current window has 'deny' option");
>+
>+</script>
>+</body>
>+</html>
>diff --git a/LayoutTests/http/wpt/cross-origin-options/allow-postmessage-from-deny.html.headers b/LayoutTests/http/wpt/cross-origin-options/allow-postmessage-from-deny.html.headers
>new file mode 100644
>index 0000000000000000000000000000000000000000..bf59633200a5c1247116c058f54fe7f56359e146
>--- /dev/null
>+++ b/LayoutTests/http/wpt/cross-origin-options/allow-postmessage-from-deny.html.headers
>@@ -0,0 +1 @@
>+Cross-Origin-Options: deny
>diff --git a/LayoutTests/http/wpt/cross-origin-options/allow-postmessage.html b/LayoutTests/http/wpt/cross-origin-options/allow-postmessage.html
>new file mode 100644
>index 0000000000000000000000000000000000000000..b11e56296fdab81a2e1f5b129454e7f250e52b31
>--- /dev/null
>+++ b/LayoutTests/http/wpt/cross-origin-options/allow-postmessage.html
>@@ -0,0 +1,47 @@
>+<!DOCTYPE html>
>+<html>
>+<head>
>+<meta charset="utf-8">
>+<title>Tests that postMessage() works when 'Cross-Origin-Options: allow-postmessage' HTTP header is served</title>
>+<script src="/resources/testharness.js"></script>
>+<script src="/resources/testharnessreport.js"></script>
>+<script src="/common/utils.js"></script>
>+<script src="/common/get-host-info.sub.js"></script>
>+<script src="resources/utils.js"></script>
>+</head>
>+<body>
>+<script>
>+
>+promise_test(function(test) {
>+    return withIframe("cross-origin-options-allow-postmessage-pong.html", true /* isCrossOrigin */).then((f) => {
>+        return new Promise((resolve) => {
>+            window.onmessage = (msg) => {
>+                window.onmessage = null;
>+                assert_equals(msg.data, "PONG");
>+                assert_equals(msg.source, f.contentWindow);
>+                resolve();
>+            };
>+            assert_throws("SecurityError", function() { f.contentWindow.length }, "length property access");
>+            f.contentWindow.postMessage("PING", "*");
>+        });
>+    });
>+}, "postMessage() on Cross-origin iframe with 'Cross-Origin-Options: allow-postmessage' HTTP header");
>+
>+promise_test(function(test) {
>+    return withPopup("cross-origin-options-allow-postmessage-pong.html", true /* isCrossOrigin */).then((result) => {
>+        return new Promise((resolve) => {
>+            window.onmessage = (msg) => {
>+                window.onmessage = null;
>+                assert_equals(msg.data, "PONG");
>+                assert_equals(msg.source, result.window);
>+                resolve();
>+            };
>+            assert_throws("SecurityError", function() { result.window.length }, "length property access");
>+            result.window.postMessage("PING", "*");
>+        });
>+    });
>+}, "postMessage() on Cross-origin popup with 'Cross-Origin-Options: allow-postmessage' HTTP header");
>+
>+</script>
>+</body>
>+</html>
>diff --git a/LayoutTests/http/wpt/cross-origin-options/cross-origin-options-header-expected.txt b/LayoutTests/http/wpt/cross-origin-options/cross-origin-options-header-expected.txt
>new file mode 100644
>index 0000000000000000000000000000000000000000..fb310842fe451eb2b6e790da6dda5d6f2da1e757
>--- /dev/null
>+++ b/LayoutTests/http/wpt/cross-origin-options/cross-origin-options-header-expected.txt
>@@ -0,0 +1,19 @@
>+  
>+
>+PASS Cross-origin iframe with 'Cross-Origin-Options: deny' HTTP header 
>+PASS Cross-origin iframe with 'Cross-Origin-Options: allow-postmessage' HTTP header 
>+PASS Cross-origin iframe with 'Cross-Origin-Options: allow' HTTP header 
>+PASS Cross-origin iframe with 'Cross-Origin-Options: invalid' HTTP header 
>+PASS Same-origin iframe with 'Cross-Origin-Options: deny' HTTP header 
>+PASS Same-origin iframe with 'Cross-Origin-Options: allow-postmessage' HTTP header 
>+PASS Same-origin iframe with 'Cross-Origin-Options: allow' HTTP header 
>+PASS Same-origin iframe with 'Cross-Origin-Options: invalid' HTTP header 
>+PASS Cross-origin popup with 'Cross-Origin-Options: deny' HTTP header 
>+PASS Cross-origin popup with 'Cross-Origin-Options: allow-postmessage' HTTP header 
>+PASS Cross-origin popup with 'Cross-Origin-Options: allow' HTTP header 
>+PASS Cross-origin popup with 'Cross-Origin-Options: invalid' HTTP header 
>+PASS Same-origin popup with 'Cross-Origin-Options: deny' HTTP header 
>+PASS Same-origin popup with 'Cross-Origin-Options: allow-postmessage' HTTP header 
>+PASS Same-origin popup with 'Cross-Origin-Options: allow' HTTP header 
>+PASS Same-origin popup with 'Cross-Origin-Options: invalid' HTTP header 
>+
>diff --git a/LayoutTests/http/wpt/cross-origin-options/cross-origin-options-header.html b/LayoutTests/http/wpt/cross-origin-options/cross-origin-options-header.html
>new file mode 100644
>index 0000000000000000000000000000000000000000..2215d0fd7284c28f2af5a9453bc9481f7548d08e
>--- /dev/null
>+++ b/LayoutTests/http/wpt/cross-origin-options/cross-origin-options-header.html
>@@ -0,0 +1,172 @@
>+<!DOCTYPE html>
>+<html>
>+<head>
>+<meta charset="utf-8">
>+<title>Basic testing for Cross-Origin-Options HTTP header</title>
>+<script src="/resources/testharness.js"></script>
>+<script src="/resources/testharnessreport.js"></script>
>+<script src="/common/utils.js"></script>
>+<script src="/common/get-host-info.sub.js"></script>
>+<script src="resources/utils.js"></script>
>+</head>
>+<body>
>+<script>
>+
>+// Test frame has a subframe so we expect an indexed property with index 0.
>+crossOriginPropertyNames.push('0');
>+
>+function checkIframePropertyValues(w)
>+{
>+    assert_equals(w.parent, window, "'parent' property value");
>+    assert_equals(w.top, window, "'top' property value");
>+    assert_equals(w.opener, null, "'opener' property value");
>+    assert_equals(w.length, 1, "'length' property value");
>+    assert_not_throwing(function() { w[0]; }, "Subframe access via index");
>+    assert_equals(w['subframe'], w[0], "Subframe access by name");
>+}
>+
>+function checkPopupPropertyValues(w)
>+{
>+    assert_equals(w.parent, w, "'parent' property value");
>+    assert_equals(w.top, w, "'top' property value");
>+    assert_equals(w.opener, window, "'opener' property value");
>+    assert_equals(w.length, 1, "'length' property value");
>+    assert_not_throwing(function() { w[0]; }, "Subframe access via index");
>+    assert_equals(w['subframe'], w[0], "Subframe access by name");
>+}
>+
>+promise_test(function(test) {
>+    return withIframe("serve-cross-origin-options-header.py?value=deny", true /* isCrossOrigin */).then((f) => {
>+        testCrossOriginOption(f.contentWindow, "deny", true /* isCrossOrigin */);
>+    });
>+}, "Cross-origin iframe with 'Cross-Origin-Options: deny' HTTP header");
>+
>+promise_test(function(test) {
>+    return withIframe("serve-cross-origin-options-header.py?value=allow-postmessage", true /* isCrossOrigin */).then((f) => {
>+        testCrossOriginOption(f.contentWindow, "allow-postmessage", true /* isCrossOrigin */);
>+    });
>+}, "Cross-origin iframe with 'Cross-Origin-Options: allow-postmessage' HTTP header");
>+
>+promise_test(function(test) {
>+    return withIframe("serve-cross-origin-options-header.py?value=allow", true /* isCrossOrigin */).then((f) => {
>+        const w = f.contentWindow;
>+        testCrossOriginOption(w, "allow", true /* isCrossOrigin */);
>+
>+        checkIframePropertyValues(w);
>+    });
>+}, "Cross-origin iframe with 'Cross-Origin-Options: allow' HTTP header");
>+
>+promise_test(function(test) {
>+    return withIframe("serve-cross-origin-options-header.py?value=invalid", true /* isCrossOrigin */).then((f) => {
>+        const w = f.contentWindow;
>+        testCrossOriginOption(w, "allow", true /* isCrossOrigin */);
>+        
>+        checkIframePropertyValues(w);
>+    });
>+}, "Cross-origin iframe with 'Cross-Origin-Options: invalid' HTTP header");
>+
>+promise_test(function(test) {
>+    return withIframe("serve-cross-origin-options-header.py?value=deny", false /* isCrossOrigin */).then((f) => {
>+         const w = f.contentWindow;
>+        testCrossOriginOption(w, "deny", false /* isCrossOrigin */);
>+
>+        checkIframePropertyValues(w);
>+    });
>+}, "Same-origin iframe with 'Cross-Origin-Options: deny' HTTP header");
>+
>+promise_test(function(test) {
>+    return withIframe("serve-cross-origin-options-header.py?value=allow-postmessage", false /* isCrossOrigin */).then((f) => {
>+         const w = f.contentWindow;
>+        testCrossOriginOption(w, "allow-postmessage", false /* isCrossOrigin */);
>+
>+        checkIframePropertyValues(w);
>+    });
>+}, "Same-origin iframe with 'Cross-Origin-Options: allow-postmessage' HTTP header");
>+
>+promise_test(function(test) {
>+    return withIframe("serve-cross-origin-options-header.py?value=allow", false /* isCrossOrigin */).then((f) => {
>+         const w = f.contentWindow;
>+        testCrossOriginOption(w, "allow", false /* isCrossOrigin */);
>+
>+        checkIframePropertyValues(w);
>+    });
>+}, "Same-origin iframe with 'Cross-Origin-Options: allow' HTTP header");
>+
>+promise_test(function(test) {
>+    return withIframe("serve-cross-origin-options-header.py?value=invalid", false /* isCrossOrigin */).then((f) => {
>+         const w = f.contentWindow;
>+        testCrossOriginOption(w, "allow", false /* isCrossOrigin */);
>+
>+        checkIframePropertyValues(w);
>+    });
>+}, "Same-origin iframe with 'Cross-Origin-Options: invalid' HTTP header");
>+
>+promise_test(function(test) {
>+    return withPopup("serve-cross-origin-options-header.py?value=deny", true /* isCrossOrigin */).then((result) => {
>+        testCrossOriginOption(result.window, "deny", true /* isCrossOrigin */);
>+    });
>+}, "Cross-origin popup with 'Cross-Origin-Options: deny' HTTP header");
>+
>+promise_test(function(test) {
>+    return withPopup("serve-cross-origin-options-header.py?value=allow-postmessage", true /* isCrossOrigin */).then((result) => {
>+        testCrossOriginOption(result.window, "allow-postmessage", true /* isCrossOrigin */);
>+    });
>+}, "Cross-origin popup with 'Cross-Origin-Options: allow-postmessage' HTTP header");
>+
>+promise_test(function(test) {
>+    return withPopup("serve-cross-origin-options-header.py?value=allow", true /* isCrossOrigin */).then((result) => {
>+        const w = result.window;
>+        testCrossOriginOption(w, "allow", true /* isCrossOrigin */);
>+
>+        checkPopupPropertyValues(w);
>+    });
>+}, "Cross-origin popup with 'Cross-Origin-Options: allow' HTTP header");
>+
>+promise_test(function(test) {
>+    return withPopup("serve-cross-origin-options-header.py?value=invalid", true /* isCrossOrigin */).then((result) => {
>+        const w = result.window;
>+        testCrossOriginOption(w, "allow", true /* isCrossOrigin */);
>+
>+        checkPopupPropertyValues(w);
>+    });
>+}, "Cross-origin popup with 'Cross-Origin-Options: invalid' HTTP header");
>+
>+promise_test(function(test) {
>+    return withPopup("serve-cross-origin-options-header.py?value=deny", false /* isCrossOrigin */).then((result) => {
>+         const w = result.window;
>+        testCrossOriginOption(w, "deny", false /* isCrossOrigin */);
>+
>+        checkPopupPropertyValues(w);
>+    });
>+}, "Same-origin popup with 'Cross-Origin-Options: deny' HTTP header");
>+
>+promise_test(function(test) {
>+    return withPopup("serve-cross-origin-options-header.py?value=allow-postmessage", false /* isCrossOrigin */).then((result) => {
>+         const w = result.window;
>+        testCrossOriginOption(w, "allow-postmessage", false /* isCrossOrigin */);
>+
>+        checkPopupPropertyValues(w);
>+    });
>+}, "Same-origin popup with 'Cross-Origin-Options: allow-postmessage' HTTP header");
>+
>+promise_test(function(test) {
>+    return withPopup("serve-cross-origin-options-header.py?value=allow", false /* isCrossOrigin */).then((result) => {
>+         const w = result.window;
>+        testCrossOriginOption(w, "allow", false /* isCrossOrigin */);
>+
>+        checkPopupPropertyValues(w);
>+    });
>+}, "Same-origin popup with 'Cross-Origin-Options: allow' HTTP header");
>+
>+promise_test(function(test) {
>+    return withPopup("serve-cross-origin-options-header.py?value=invalid", false /* isCrossOrigin */).then((result) => {
>+         const w = result.window;
>+        testCrossOriginOption(w, "allow", false /* isCrossOrigin */);
>+
>+        checkPopupPropertyValues(w);
>+    });
>+}, "Same-origin popup with 'Cross-Origin-Options: invalid' HTTP header");
>+
>+</script>
>+</body>
>+</html>
>diff --git a/LayoutTests/http/wpt/cross-origin-options/resources/cross-origin-options-allow-postmessage-pong.html b/LayoutTests/http/wpt/cross-origin-options/resources/cross-origin-options-allow-postmessage-pong.html
>new file mode 100644
>index 0000000000000000000000000000000000000000..9a67dd7f60c14d62fcd15a6cacea687b4d0f5836
>--- /dev/null
>+++ b/LayoutTests/http/wpt/cross-origin-options/resources/cross-origin-options-allow-postmessage-pong.html
>@@ -0,0 +1,17 @@
>+<!DOCTYPE html>
>+<html>
>+<body>
>+<script>
>+addEventListener('message', (msg) => {
>+    if (event.data === "PING")
>+        event.source.postMessage("PONG", "*");
>+    });
>+    window.addEventListener('load', () => {
>+        const ownerWindow = window.opener ? window.opener : window.top;
>+        try {
>+            ownerWindow.postMessage("READY", "*");
>+        } catch (e) { }
>+    });
>+</script>
>+</body>
>+</html>
>diff --git a/LayoutTests/http/wpt/cross-origin-options/resources/cross-origin-options-allow-postmessage-pong.html.headers b/LayoutTests/http/wpt/cross-origin-options/resources/cross-origin-options-allow-postmessage-pong.html.headers
>new file mode 100644
>index 0000000000000000000000000000000000000000..cfb12bb1061bd5a091450ebf113ccede967a9397
>--- /dev/null
>+++ b/LayoutTests/http/wpt/cross-origin-options/resources/cross-origin-options-allow-postmessage-pong.html.headers
>@@ -0,0 +1 @@
>+Cross-Origin-Options: allow-postmessage
>diff --git a/LayoutTests/http/wpt/cross-origin-options/resources/serve-cross-origin-options-header.py b/LayoutTests/http/wpt/cross-origin-options/resources/serve-cross-origin-options-header.py
>new file mode 100644
>index 0000000000000000000000000000000000000000..ea90655adc31b53bdce62aa824536bc997126235
>--- /dev/null
>+++ b/LayoutTests/http/wpt/cross-origin-options/resources/serve-cross-origin-options-header.py
>@@ -0,0 +1,14 @@
>+def main(request, response):
>+    headers = [("Content-Type", "text/html"),
>+               ("Cross-Origin-Options", request.GET['value']),]
>+    return 200, headers, """TEST
>+        <iframe name="subframe"></iframe>
>+        <script>
>+            window.addEventListener('load', () => {
>+                const ownerWindow = window.opener ? window.opener : window.top;
>+                try {
>+                    ownerWindow.postMessage("READY", "*");
>+                } catch (e) { }
>+            });
>+        </script>
>+    """
>diff --git a/LayoutTests/http/wpt/cross-origin-options/resources/utils.js b/LayoutTests/http/wpt/cross-origin-options/resources/utils.js
>new file mode 100644
>index 0000000000000000000000000000000000000000..3d31672839005d83fb047c722e8f14e9d651df9b
>--- /dev/null
>+++ b/LayoutTests/http/wpt/cross-origin-options/resources/utils.js
>@@ -0,0 +1,150 @@
>+const RESOURCES_DIR = "/WebKit/cross-origin-options/resources/";
>+
>+function isCrossOriginWindow(w)
>+{
>+    try {
>+        w.name;
>+    } catch (e) {
>+        return true;
>+    }
>+    return false;
>+}
>+
>+async function waitForCrossOriginLoad(w)
>+{
>+    return new Promise((resolve) => {
>+        window.addEventListener('message', (msg) => {
>+            if (msg.source != w || msg.data != "READY")
>+                return;
>+            resolve();
>+        });
>+
>+        let handle = setInterval(() => {
>+            if (isCrossOriginWindow(w)) {
>+                clearInterval(handle);
>+                try {
>+                    w.postMessage;
>+                } catch (e) {
>+                    // No point in waiting for "READY" message from window since postMessage is
>+                    // not available.
>+                    resolve();
>+                }
>+            }
>+        }, 5);
>+    });
>+}
>+
>+async function withIframe(resourceFile, crossOrigin)
>+{
>+    return new Promise((resolve) => {
>+        let resourceURL = crossOrigin ? get_host_info().HTTP_REMOTE_ORIGIN : get_host_info().HTTP_ORIGIN;
>+        resourceURL += RESOURCES_DIR;
>+        resourceURL += resourceFile;
>+        let frame = document.createElement("iframe");
>+        frame.src = resourceURL;
>+        if (crossOrigin) {
>+            document.body.appendChild(frame);
>+            waitForCrossOriginLoad(frame.contentWindow).then(() => {
>+                resolve(frame);
>+            });
>+        } else {
>+            frame.onload = function() { resolve(frame); };
>+            document.body.appendChild(frame);
>+        }
>+    });
>+}
>+
>+async function withPopup(resourceFile, crossOrigin)
>+{
>+    return new Promise((resolve) => { 
>+        let resourceURL = crossOrigin ? get_host_info().HTTP_REMOTE_ORIGIN : get_host_info().HTTP_ORIGIN;
>+        resourceURL += RESOURCES_DIR;
>+        resourceURL += resourceFile;
>+
>+        let w = open(resourceURL);
>+        if (crossOrigin) {
>+            waitForCrossOriginLoad(w).then(() => {
>+                resolve({ 'window': w });
>+            });
>+        } else {
>+            w.onload = function() { resolve({ 'window': w }); };
>+        }
>+   });
>+}
>+
>+const crossOriginPropertyNames = [ 'blur', 'close', 'closed', 'focus', 'frames', 'length', 'location', 'opener', 'parent', 'postMessage', 'self', 'top', 'window' ];
>+const forbiddenPropertiesCrossOrigin = ["name", "document", "history", "locationbar", "status", "frameElement", "navigator", "alert", "localStorage", "sessionStorage", "event", "foo", "bar"];
>+
>+function assert_not_throwing(f, message)
>+{
>+    try {
>+        f();
>+    } catch (e) {
>+        assert_unreached(message);
>+    }
>+}
>+
>+function checkCrossOriginPropertiesAccess(w)
>+{
>+    for (let crossOriginPropertyName of crossOriginPropertyNames)
>+       assert_not_throwing(function() { w[crossOriginPropertyName]; }, "Accessing property '" + crossOriginPropertyName +"' on Window should not throw");
>+   
>+    assert_false(w.closed, "'closed' property value"); 
>+    assert_equals(w.frames, w, "'frames' property value");
>+    assert_equals(w.self, w, "'self' property value");
>+    assert_equals(w.window, w, "'window' property value");
>+
>+    assert_not_throwing(function() { w.blur(); }, "Calling blur() on Window should should throw");
>+    assert_not_throwing(function() { w.focus(); }, "Calling focus() on Window should should throw");
>+    assert_not_throwing(function() { w.postMessage('test', '*'); }, "Calling postMessage() on Window should should throw");
>+}
>+
>+function testCrossOriginOption(w, headerValue, isCrossOrigin)
>+{
>+    if (!isCrossOrigin) {
>+        checkCrossOriginPropertiesAccess(w);
>+        for (let forbiddenPropertyCrossOrigin of forbiddenPropertiesCrossOrigin)
>+            assert_not_throwing(function() { eval("w." + forbiddenPropertyCrossOrigin); }, "Accessing property '" + forbiddenPropertyCrossOrigin + "' on Window should not throw");
>+        assert_not_throwing(function() { w.foo = 1; }, "Setting expando property should not throw");
>+        assert_equals(w.foo, 1, "expando property value");
>+        return;
>+    }
>+
>+    // Cross-origin case.
>+    for (let forbiddenPropertyCrossOrigin of forbiddenPropertiesCrossOrigin) {
>+        assert_throws("SecurityError", function() { eval("w." + forbiddenPropertyCrossOrigin); }, "Accessing property '" + forbiddenPropertyCrossOrigin + "' on Window should throw");
>+        let desc = Object.getOwnPropertyDescriptor(window, forbiddenPropertyCrossOrigin);
>+        if (desc && desc.value)
>+            assert_throws("SecurityError", function() { desc.value.call(w); }, "Calling function '" + forbiddenPropertyCrossOrigin + "' on Window should throw (using getter from other window)");
>+        else if (desc && desc.get)
>+            assert_throws("SecurityError", function() { desc.get.call(w); }, "Accessing property '" + forbiddenPropertyCrossOrigin + "' on Window should throw (using getter from other window)");
>+    }
>+    assert_throws("SecurityError", function() { w.foo = 1; }, "Setting an expando property should throw");
>+
>+    if (headerValue == "deny" || headerValue == "allow-postmessage") {
>+        for (let crossOriginPropertyName of crossOriginPropertyNames) {
>+            if (headerValue == "allow-postmessage" && crossOriginPropertyName == "postMessage") {
>+                assert_not_throwing(function() { w[crossOriginPropertyName]; }, "Accessing property '" + crossOriginPropertyName +"' on Window should not throw");
>+            } else {
>+                assert_throws("SecurityError", function() { w[crossOriginPropertyName]; }, "Accessing '" + crossOriginPropertyName + "' property");
>+
>+                let desc = Object.getOwnPropertyDescriptor(window, crossOriginPropertyName);
>+                if (desc && desc.value)
>+                    assert_throws("SecurityError", function() { desc.value.call(w); }, "Calling function '" + crossOriginPropertyName + "' on Window should throw (using getter from other window)");
>+                else if (desc && desc.get)
>+                    assert_throws("SecurityError", function() { desc.get.call(w); }, "Accessing property '" + crossOriginPropertyName + "' on Window should throw (using getter from other window)");
>+            }
>+        }
>+        if (headerValue == "allow-postmessage") {
>+            assert_not_throwing(function() { w.postMessage('test', '*'); }, "Calling postMessage() on Window should not throw");
>+            assert_not_throwing(function() { Object.getOwnPropertyDescriptor(window, 'postMessage').value.call(w, 'test', '*'); }, "Calling postMessage() on Window should not throw (using getter from other window)");
>+        }
>+
>+        assert_array_equals(Object.getOwnPropertyNames(w).sort(), headerValue == "allow-postmessage" ? ['postMessage'] : [], "Object.getOwnPropertyNames()");
>+
>+        return;
>+    }
>+
>+    assert_array_equals(Object.getOwnPropertyNames(w).sort(), crossOriginPropertyNames.sort(), "Object.getOwnPropertyNames()");
>+    checkCrossOriginPropertiesAccess(w);
>+}

Actions: View | Formatted Diff | Diff

Attachments on bug 184996: 338788 | 338803 | 338811 | 338812 | 338820 | 338825 | 338840 | 339215 | 339223 | 339225 | 339226 | 339242 | 339897 | 339922 | 339923 | 339973 | 339978 | 339980 | 339995 | 339998 | 340000 | 340007 | 340010 | 340022 | 340031 | 340035 | 340039 | 340041 | 340042 | 340046 | 340047 | 340049