Code: void V8ContextNativeHandler::RunWithNativesEnabledModuleSystem(
     const v8::FunctionCallbackInfo<v8::Value>& args) {
   CHECK_EQ(args.Length(), 1);
   CHECK(args[0]->IsFunction());
  v8::Local<v8::Value> call_with_args[] = {
    context()->module_system()->NewInstance()};
   ModuleSystem::NativesEnabledScope natives_enabled(context()->module_system());
  context()->CallFunction(v8::Local<v8::Function>::Cast(args[0]), 1,
                          call_with_args);
 }

Vulnerability Type: XSS 
CWE ID: CWE-79
Summary: Cross-site scripting (XSS) vulnerability in the V8ContextNativeHandler::GetModuleSystem function in extensions/renderer/v8_context_native_handler.cc in Google Chrome before 44.0.2403.89 allows remote attackers to inject arbitrary web script or HTML by leveraging the lack of a certain V8 context restriction, aka a Blink *Universal XSS (UXSS).*
Commit Message: Add a test that getModuleSystem() doesn't work cross origin

BUG=504011
R=kalman@chromium.org
TBR=fukino@chromium.org

Review URL: https://codereview.chromium.org/1241443004

Cr-Commit-Position: refs/heads/master@{#338663}