Drop full URLs from cross-origin access errors caused by sandboxing.
https://bugs.webkit.org/show_bug.cgi?id=113029

Reviewed by Timothy Hatcher.

Source/WebCore:

Following up on http://wkbug.com/112042, this patch brings cross-origin
access error messages into line with the newly origin-only default
message, and changes the error message text to explicitly refer to the
missing 'allow-same-origin' sandbox flag that's the root cause of the
error.

* page/DOMWindow.cpp:
(WebCore::DOMWindow::crossDomainAccessErrorMessage):
    Note that we're using the origin of the frames' URLs rather than
    their actual origin in these messages. This seems like a reasonable
    thing to do, since we know that at least one of the two origins will
    be "null" in this scenario.

LayoutTests:

* http/tests/security/contentSecurityPolicy/sandbox-allow-scripts-in-http-header-expected.txt:
* http/tests/security/contentSecurityPolicy/sandbox-in-http-header-expected.txt:
* http/tests/security/sandboxed-iframe-blocks-access-from-parent-expected.txt:
* http/tests/security/sandboxed-iframe-origin-add-expected.txt:
* http/tests/security/sandboxed-iframe-origin-remove-expected.txt:
* http/tests/security/xss-DENIED-sandboxed-iframe-expected.txt:
* platform/chromium/http/tests/security/sandboxed-iframe-modify-self-expected.txt:
* platform/chromium/http/tests/security/srcdoc-in-sandbox-cannot-access-parent-expected.txt:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@146725 268f45cc-cd09-0410-ab3c-d52691b4dbfc