document.open() should throw errors for cross-origin calls

[Timothy Gu]

https://html.spec.whatwg.org/multipage/dynamic-markup-insertion.html#document-open-steps has:

> 3. Let entryDocument be the responsible document specified by the entry settings object.
>
> 4. If document's origin is not same origin to entryDocument's origin, then throw a "SecurityError" DOMException.

This also applies to implicit calls to document.open() by way of document.write().

Tests:
- https://github.com/web-platform-tests/wpt/blob/master/html/webappapis/dynamic-markup-insertion/opening-the-input-stream/bailout-exception-vs-return-origin.sub.window.js
- https://github.com/web-platform-tests/wpt/blob/master/html/webappapis/dynamic-markup-insertion/opening-the-input-stream/origin-check-in-document-open-same-origin-domain.sub.html

[Timothy Gu]

Another test:

- https://github.com/web-platform-tests/wpt/blob/master/html/webappapis/dynamic-markup-insertion/opening-the-input-stream/bailout-side-effects-same-origin-domain.sub.window.html

[Radar WebKit Bug Importer]

<rdar://problem/44282700>

[Chris Dumez]

Created attachment 350979 [details]
Patch

[Chris Dumez]

Created attachment 350983 [details]
Patch

[Chris Dumez]

ping review?

[WebKit Commit Bot]

Comment on attachment 350983 [details]
Patch

Clearing flags on attachment: 350983

Committed r236613: <https://trac.webkit.org/changeset/236613>

[WebKit Commit Bot]

All reviewed patches have been landed.  Closing bug.