Allow subframes that come from a different domain to document.write/open

themselves.  Bug 362837, r+sr=jst

content/html/document/src/nsHTMLDocument.cpp

@@ -1896,6 +1896,7 @@ nsHTMLDocument::OpenCommon(const nsACString& aContentType, PRBool aReplace)
 
   nsresult rv = NS_OK;
 
+  if (!nsContentUtils::CanCallerAccess(NS_STATIC_CAST(nsIDOMHTMLDocument*, this))) {
     nsPIDOMWindow *win = GetWindow();
     if (win) {
       nsCOMPtr<nsIDOMElement> frameElement;
@@ -1906,6 +1907,7 @@ nsHTMLDocument::OpenCommon(const nsACString& aContentType, PRBool aReplace)
         return NS_ERROR_DOM_SECURITY_ERR;
       }
     }
+  }
 
   // If we already have a parser we ignore the document.open call.
   if (mParser) {