Code: V8ContextNativeHandler::V8ContextNativeHandler(ScriptContext* context,
                                               Dispatcher* dispatcher)
    : ObjectBackedNativeHandler(context),
      context_(context),
      dispatcher_(dispatcher) {
  RouteFunction("GetAvailability",
                base::Bind(&V8ContextNativeHandler::GetAvailability,
                           base::Unretained(this)));
  RouteFunction("GetModuleSystem",
                 base::Bind(&V8ContextNativeHandler::GetModuleSystem,
                            base::Unretained(this)));
   RouteFunction(
      "RunWithNativesEnabledModuleSystem",
      base::Bind(&V8ContextNativeHandler::RunWithNativesEnabledModuleSystem,
                  base::Unretained(this)));
 }

Vulnerability Type: XSS 
CWE ID: CWE-79
Summary: Cross-site scripting (XSS) vulnerability in the V8ContextNativeHandler::GetModuleSystem function in extensions/renderer/v8_context_native_handler.cc in Google Chrome before 44.0.2403.89 allows remote attackers to inject arbitrary web script or HTML by leveraging the lack of a certain V8 context restriction, aka a Blink *Universal XSS (UXSS).*
Commit Message: Add a test that getModuleSystem() doesn't work cross origin

BUG=504011
R=kalman@chromium.org
TBR=fukino@chromium.org

Review URL: https://codereview.chromium.org/1241443004

Cr-Commit-Position: refs/heads/master@{#338663}