1d0825bca7fe65beaee391d30da42e937db621564Steve Block/* 2d0825bca7fe65beaee391d30da42e937db621564Steve Block * Copyright (C) 2008, 2009 Google Inc. All rights reserved. 3d0825bca7fe65beaee391d30da42e937db621564Steve Block * 4d0825bca7fe65beaee391d30da42e937db621564Steve Block * Redistribution and use in source and binary forms, with or without 5d0825bca7fe65beaee391d30da42e937db621564Steve Block * modification, are permitted provided that the following conditions are 6d0825bca7fe65beaee391d30da42e937db621564Steve Block * met: 7d0825bca7fe65beaee391d30da42e937db621564Steve Block * 8d0825bca7fe65beaee391d30da42e937db621564Steve Block * * Redistributions of source code must retain the above copyright 9d0825bca7fe65beaee391d30da42e937db621564Steve Block * notice, this list of conditions and the following disclaimer. 10d0825bca7fe65beaee391d30da42e937db621564Steve Block * * Redistributions in binary form must reproduce the above 11d0825bca7fe65beaee391d30da42e937db621564Steve Block * copyright notice, this list of conditions and the following disclaimer 12d0825bca7fe65beaee391d30da42e937db621564Steve Block * in the documentation and/or other materials provided with the 13d0825bca7fe65beaee391d30da42e937db621564Steve Block * distribution. 14d0825bca7fe65beaee391d30da42e937db621564Steve Block * * Neither the name of Google Inc. nor the names of its 15d0825bca7fe65beaee391d30da42e937db621564Steve Block * contributors may be used to endorse or promote products derived from 16d0825bca7fe65beaee391d30da42e937db621564Steve Block * this software without specific prior written permission. 17d0825bca7fe65beaee391d30da42e937db621564Steve Block * 18d0825bca7fe65beaee391d30da42e937db621564Steve Block * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 19d0825bca7fe65beaee391d30da42e937db621564Steve Block * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT 20d0825bca7fe65beaee391d30da42e937db621564Steve Block * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR 21d0825bca7fe65beaee391d30da42e937db621564Steve Block * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT 22d0825bca7fe65beaee391d30da42e937db621564Steve Block * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, 23d0825bca7fe65beaee391d30da42e937db621564Steve Block * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT 24d0825bca7fe65beaee391d30da42e937db621564Steve Block * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 25d0825bca7fe65beaee391d30da42e937db621564Steve Block * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 26d0825bca7fe65beaee391d30da42e937db621564Steve Block * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 27d0825bca7fe65beaee391d30da42e937db621564Steve Block * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE 28d0825bca7fe65beaee391d30da42e937db621564Steve Block * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 29d0825bca7fe65beaee391d30da42e937db621564Steve Block */ 30d0825bca7fe65beaee391d30da42e937db621564Steve Block 31d0825bca7fe65beaee391d30da42e937db621564Steve Block#include "config.h" 32d0825bca7fe65beaee391d30da42e937db621564Steve Block#include "V8DOMWindowShell.h" 33d0825bca7fe65beaee391d30da42e937db621564Steve Block 34d0825bca7fe65beaee391d30da42e937db621564Steve Block#include "PlatformBridge.h" 35d0825bca7fe65beaee391d30da42e937db621564Steve Block#include "CSSMutableStyleDeclaration.h" 36d0825bca7fe65beaee391d30da42e937db621564Steve Block#include "DateExtension.h" 37d0825bca7fe65beaee391d30da42e937db621564Steve Block#include "DocumentLoader.h" 38d0825bca7fe65beaee391d30da42e937db621564Steve Block#include "Frame.h" 39d0825bca7fe65beaee391d30da42e937db621564Steve Block#include "FrameLoaderClient.h" 40d0825bca7fe65beaee391d30da42e937db621564Steve Block#include "Page.h" 41d0825bca7fe65beaee391d30da42e937db621564Steve Block#include "PageGroup.h" 422fc2651226baac27029e38c9d6ef883fa32084dbSteve Block#include "RuntimeEnabledFeatures.h" 43ab9e7a118cf1ea2e3a93dce683b2ded3e7291ddbBen Murdoch#include "ScriptCallStack.h" 44ab9e7a118cf1ea2e3a93dce683b2ded3e7291ddbBen Murdoch#include "ScriptCallStackFactory.h" 45d0825bca7fe65beaee391d30da42e937db621564Steve Block#include "ScriptController.h" 462bde8e466a4451c7319e3a072d118917957d6554Steve Block#include "ScriptProfiler.h" 47d0825bca7fe65beaee391d30da42e937db621564Steve Block#include "StorageNamespace.h" 48d0825bca7fe65beaee391d30da42e937db621564Steve Block#include "V8Binding.h" 49d0825bca7fe65beaee391d30da42e937db621564Steve Block#include "V8BindingState.h" 50d0825bca7fe65beaee391d30da42e937db621564Steve Block#include "V8Collection.h" 51d0825bca7fe65beaee391d30da42e937db621564Steve Block#include "V8DOMMap.h" 52d0825bca7fe65beaee391d30da42e937db621564Steve Block#include "V8DOMWindow.h" 535e2bc6953fe6923165b8a5d7679939693a1d58d6Steve Block#include "V8Document.h" 54dcc8cf2e65d1aa555cce12431a16547e66b469eeSteve Block#include "V8GCForContextDispose.h" 55f486d19d62f1bc33246748b14b14a9dfa617b57fIain Merrick#include "V8HTMLDocument.h" 56d0825bca7fe65beaee391d30da42e937db621564Steve Block#include "V8HiddenPropertyName.h" 57d0825bca7fe65beaee391d30da42e937db621564Steve Block#include "V8History.h" 58d0825bca7fe65beaee391d30da42e937db621564Steve Block#include "V8Location.h" 59d0825bca7fe65beaee391d30da42e937db621564Steve Block#include "V8Proxy.h" 60d0825bca7fe65beaee391d30da42e937db621564Steve Block#include "WorkerContextExecutionProxy.h" 61d0825bca7fe65beaee391d30da42e937db621564Steve Block 62d0825bca7fe65beaee391d30da42e937db621564Steve Block#include <algorithm> 63d0825bca7fe65beaee391d30da42e937db621564Steve Block#include <stdio.h> 64d0825bca7fe65beaee391d30da42e937db621564Steve Block#include <utility> 65d0825bca7fe65beaee391d30da42e937db621564Steve Block#include <v8-debug.h> 66d0825bca7fe65beaee391d30da42e937db621564Steve Block#include <v8.h> 672fc2651226baac27029e38c9d6ef883fa32084dbSteve Block 682fc2651226baac27029e38c9d6ef883fa32084dbSteve Block#if ENABLE(JAVASCRIPT_I18N_API) 692fc2651226baac27029e38c9d6ef883fa32084dbSteve Block#include <v8/src/extensions/experimental/i18n-extension.h> 702fc2651226baac27029e38c9d6ef883fa32084dbSteve Block#endif 712fc2651226baac27029e38c9d6ef883fa32084dbSteve Block 72d0825bca7fe65beaee391d30da42e937db621564Steve Block#include <wtf/Assertions.h> 73d0825bca7fe65beaee391d30da42e937db621564Steve Block#include <wtf/OwnArrayPtr.h> 74d0825bca7fe65beaee391d30da42e937db621564Steve Block#include <wtf/StdLibExtras.h> 75d0825bca7fe65beaee391d30da42e937db621564Steve Block#include <wtf/StringExtras.h> 76d0825bca7fe65beaee391d30da42e937db621564Steve Block#include <wtf/UnusedParam.h> 77dcc8cf2e65d1aa555cce12431a16547e66b469eeSteve Block#include <wtf/text/CString.h> 78d0825bca7fe65beaee391d30da42e937db621564Steve Block 79d0825bca7fe65beaee391d30da42e937db621564Steve Blocknamespace WebCore { 80d0825bca7fe65beaee391d30da42e937db621564Steve Block 81d0825bca7fe65beaee391d30da42e937db621564Steve Blockstatic void handleFatalErrorInV8() 82d0825bca7fe65beaee391d30da42e937db621564Steve Block{ 83d0825bca7fe65beaee391d30da42e937db621564Steve Block // FIXME: We temporarily deal with V8 internal error situations 84d0825bca7fe65beaee391d30da42e937db621564Steve Block // such as out-of-memory by crashing the renderer. 85d0825bca7fe65beaee391d30da42e937db621564Steve Block CRASH(); 86d0825bca7fe65beaee391d30da42e937db621564Steve Block} 87d0825bca7fe65beaee391d30da42e937db621564Steve Block 88d0825bca7fe65beaee391d30da42e937db621564Steve Blockstatic void reportFatalErrorInV8(const char* location, const char* message) 89d0825bca7fe65beaee391d30da42e937db621564Steve Block{ 90d0825bca7fe65beaee391d30da42e937db621564Steve Block // V8 is shutdown, we cannot use V8 api. 91d0825bca7fe65beaee391d30da42e937db621564Steve Block // The only thing we can do is to disable JavaScript. 92d0825bca7fe65beaee391d30da42e937db621564Steve Block // FIXME: clean up V8Proxy and disable JavaScript. 93dd8bb3de4f353a81954234999f1fea748aee2ea9Ben Murdoch int memoryUsageMB = -1; 94dd8bb3de4f353a81954234999f1fea748aee2ea9Ben Murdoch#if PLATFORM(CHROMIUM) 95ab9e7a118cf1ea2e3a93dce683b2ded3e7291ddbBen Murdoch memoryUsageMB = PlatformBridge::actualMemoryUsageMB(); 96dd8bb3de4f353a81954234999f1fea748aee2ea9Ben Murdoch#endif 97dd8bb3de4f353a81954234999f1fea748aee2ea9Ben Murdoch printf("V8 error: %s (%s). Current memory usage: %d MB\n", message, location, memoryUsageMB); 98d0825bca7fe65beaee391d30da42e937db621564Steve Block handleFatalErrorInV8(); 99d0825bca7fe65beaee391d30da42e937db621564Steve Block} 100d0825bca7fe65beaee391d30da42e937db621564Steve Block 101ab9e7a118cf1ea2e3a93dce683b2ded3e7291ddbBen Murdochstatic void v8UncaughtExceptionHandler(v8::Handle<v8::Message> message, v8::Handle<v8::Value> data) 102ab9e7a118cf1ea2e3a93dce683b2ded3e7291ddbBen Murdoch{ 103ab9e7a118cf1ea2e3a93dce683b2ded3e7291ddbBen Murdoch // Use the frame where JavaScript is called from. 104ab9e7a118cf1ea2e3a93dce683b2ded3e7291ddbBen Murdoch Frame* frame = V8Proxy::retrieveFrameForEnteredContext(); 105ab9e7a118cf1ea2e3a93dce683b2ded3e7291ddbBen Murdoch if (!frame) 106ab9e7a118cf1ea2e3a93dce683b2ded3e7291ddbBen Murdoch return; 107ab9e7a118cf1ea2e3a93dce683b2ded3e7291ddbBen Murdoch 108ab9e7a118cf1ea2e3a93dce683b2ded3e7291ddbBen Murdoch v8::Handle<v8::String> errorMessageString = message->Get(); 109ab9e7a118cf1ea2e3a93dce683b2ded3e7291ddbBen Murdoch ASSERT(!errorMessageString.IsEmpty()); 110ab9e7a118cf1ea2e3a93dce683b2ded3e7291ddbBen Murdoch String errorMessage = toWebCoreString(errorMessageString); 111ab9e7a118cf1ea2e3a93dce683b2ded3e7291ddbBen Murdoch 112ab9e7a118cf1ea2e3a93dce683b2ded3e7291ddbBen Murdoch v8::Handle<v8::StackTrace> stackTrace = message->GetStackTrace(); 113ab9e7a118cf1ea2e3a93dce683b2ded3e7291ddbBen Murdoch RefPtr<ScriptCallStack> callStack; 114ab9e7a118cf1ea2e3a93dce683b2ded3e7291ddbBen Murdoch // Currently stack trace is only collected when inspector is open. 115ab9e7a118cf1ea2e3a93dce683b2ded3e7291ddbBen Murdoch if (!stackTrace.IsEmpty() && stackTrace->GetFrameCount() > 0) 116ab9e7a118cf1ea2e3a93dce683b2ded3e7291ddbBen Murdoch callStack = createScriptCallStack(stackTrace, ScriptCallStack::maxCallStackSizeToCapture); 117ab9e7a118cf1ea2e3a93dce683b2ded3e7291ddbBen Murdoch 118ab9e7a118cf1ea2e3a93dce683b2ded3e7291ddbBen Murdoch v8::Handle<v8::Value> resourceName = message->GetScriptResourceName(); 119ab9e7a118cf1ea2e3a93dce683b2ded3e7291ddbBen Murdoch bool useURL = resourceName.IsEmpty() || !resourceName->IsString(); 120ab9e7a118cf1ea2e3a93dce683b2ded3e7291ddbBen Murdoch Document* document = frame->document(); 121ab9e7a118cf1ea2e3a93dce683b2ded3e7291ddbBen Murdoch String resourceNameString = useURL ? document->url() : toWebCoreString(resourceName); 122ab9e7a118cf1ea2e3a93dce683b2ded3e7291ddbBen Murdoch document->reportException(errorMessage, message->GetLineNumber(), resourceNameString, callStack); 123ab9e7a118cf1ea2e3a93dce683b2ded3e7291ddbBen Murdoch} 124ab9e7a118cf1ea2e3a93dce683b2ded3e7291ddbBen Murdoch 125d0825bca7fe65beaee391d30da42e937db621564Steve Block// Returns the owner frame pointer of a DOM wrapper object. It only works for 126d0825bca7fe65beaee391d30da42e937db621564Steve Block// these DOM objects requiring cross-domain access check. 127d0825bca7fe65beaee391d30da42e937db621564Steve Blockstatic Frame* getTargetFrame(v8::Local<v8::Object> host, v8::Local<v8::Value> data) 128d0825bca7fe65beaee391d30da42e937db621564Steve Block{ 129d0825bca7fe65beaee391d30da42e937db621564Steve Block Frame* target = 0; 130dcc8cf2e65d1aa555cce12431a16547e66b469eeSteve Block WrapperTypeInfo* type = WrapperTypeInfo::unwrap(data); 131dcc8cf2e65d1aa555cce12431a16547e66b469eeSteve Block if (V8DOMWindow::info.equals(type)) { 1328a0914b749bbe7da7768e07a7db5c6d4bb09472bSteve Block v8::Handle<v8::Object> window = V8DOMWrapper::lookupDOMWrapper(V8DOMWindow::GetTemplate(), host); 133d0825bca7fe65beaee391d30da42e937db621564Steve Block if (window.IsEmpty()) 134d0825bca7fe65beaee391d30da42e937db621564Steve Block return target; 135d0825bca7fe65beaee391d30da42e937db621564Steve Block 136d0825bca7fe65beaee391d30da42e937db621564Steve Block DOMWindow* targetWindow = V8DOMWindow::toNative(window); 137d0825bca7fe65beaee391d30da42e937db621564Steve Block target = targetWindow->frame(); 138dcc8cf2e65d1aa555cce12431a16547e66b469eeSteve Block } else if (V8History::info.equals(type)) { 139d0825bca7fe65beaee391d30da42e937db621564Steve Block History* history = V8History::toNative(host); 140d0825bca7fe65beaee391d30da42e937db621564Steve Block target = history->frame(); 141dcc8cf2e65d1aa555cce12431a16547e66b469eeSteve Block } else if (V8Location::info.equals(type)) { 142d0825bca7fe65beaee391d30da42e937db621564Steve Block Location* location = V8Location::toNative(host); 143d0825bca7fe65beaee391d30da42e937db621564Steve Block target = location->frame(); 144d0825bca7fe65beaee391d30da42e937db621564Steve Block } 145d0825bca7fe65beaee391d30da42e937db621564Steve Block return target; 146d0825bca7fe65beaee391d30da42e937db621564Steve Block} 147d0825bca7fe65beaee391d30da42e937db621564Steve Block 148d0825bca7fe65beaee391d30da42e937db621564Steve Blockstatic void reportUnsafeJavaScriptAccess(v8::Local<v8::Object> host, v8::AccessType type, v8::Local<v8::Value> data) 149d0825bca7fe65beaee391d30da42e937db621564Steve Block{ 150d0825bca7fe65beaee391d30da42e937db621564Steve Block Frame* target = getTargetFrame(host, data); 151d0825bca7fe65beaee391d30da42e937db621564Steve Block if (target) 152ab9e7a118cf1ea2e3a93dce683b2ded3e7291ddbBen Murdoch V8Proxy::reportUnsafeAccessTo(target); 153d0825bca7fe65beaee391d30da42e937db621564Steve Block} 154d0825bca7fe65beaee391d30da42e937db621564Steve Block 155d0825bca7fe65beaee391d30da42e937db621564Steve BlockPassRefPtr<V8DOMWindowShell> V8DOMWindowShell::create(Frame* frame) 156d0825bca7fe65beaee391d30da42e937db621564Steve Block{ 157d0825bca7fe65beaee391d30da42e937db621564Steve Block return adoptRef(new V8DOMWindowShell(frame)); 158d0825bca7fe65beaee391d30da42e937db621564Steve Block} 159d0825bca7fe65beaee391d30da42e937db621564Steve Block 160d0825bca7fe65beaee391d30da42e937db621564Steve BlockV8DOMWindowShell::V8DOMWindowShell(Frame* frame) 161d0825bca7fe65beaee391d30da42e937db621564Steve Block : m_frame(frame) 162d0825bca7fe65beaee391d30da42e937db621564Steve Block{ 163d0825bca7fe65beaee391d30da42e937db621564Steve Block} 164d0825bca7fe65beaee391d30da42e937db621564Steve Block 165d0825bca7fe65beaee391d30da42e937db621564Steve Blockbool V8DOMWindowShell::isContextInitialized() 166d0825bca7fe65beaee391d30da42e937db621564Steve Block{ 167d0825bca7fe65beaee391d30da42e937db621564Steve Block // m_context, m_global, and m_wrapperBoilerplates should 168d0825bca7fe65beaee391d30da42e937db621564Steve Block // all be non-empty if if m_context is non-empty. 169d0825bca7fe65beaee391d30da42e937db621564Steve Block ASSERT(m_context.IsEmpty() || !m_global.IsEmpty()); 170d0825bca7fe65beaee391d30da42e937db621564Steve Block return !m_context.IsEmpty(); 171d0825bca7fe65beaee391d30da42e937db621564Steve Block} 172d0825bca7fe65beaee391d30da42e937db621564Steve Block 173d0825bca7fe65beaee391d30da42e937db621564Steve Blockvoid V8DOMWindowShell::disposeContextHandles() 174d0825bca7fe65beaee391d30da42e937db621564Steve Block{ 175d0825bca7fe65beaee391d30da42e937db621564Steve Block if (!m_context.IsEmpty()) { 176d0825bca7fe65beaee391d30da42e937db621564Steve Block m_frame->loader()->client()->didDestroyScriptContextForFrame(); 177d0825bca7fe65beaee391d30da42e937db621564Steve Block m_context.Dispose(); 178d0825bca7fe65beaee391d30da42e937db621564Steve Block m_context.Clear(); 179dcc8cf2e65d1aa555cce12431a16547e66b469eeSteve Block 180dcc8cf2e65d1aa555cce12431a16547e66b469eeSteve Block // It's likely that disposing the context has created a lot of 181dcc8cf2e65d1aa555cce12431a16547e66b469eeSteve Block // garbage. Notify V8 about this so it'll have a chance of cleaning 182dcc8cf2e65d1aa555cce12431a16547e66b469eeSteve Block // it up when idle. 183dcc8cf2e65d1aa555cce12431a16547e66b469eeSteve Block V8GCForContextDispose::instance().notifyContextDisposed(); 184d0825bca7fe65beaee391d30da42e937db621564Steve Block } 185d0825bca7fe65beaee391d30da42e937db621564Steve Block 186dcc8cf2e65d1aa555cce12431a16547e66b469eeSteve Block WrapperBoilerplateMap::iterator it = m_wrapperBoilerplates.begin(); 187dcc8cf2e65d1aa555cce12431a16547e66b469eeSteve Block for (; it != m_wrapperBoilerplates.end(); ++it) { 188dcc8cf2e65d1aa555cce12431a16547e66b469eeSteve Block v8::Persistent<v8::Object> wrapper = it->second; 189dcc8cf2e65d1aa555cce12431a16547e66b469eeSteve Block wrapper.Dispose(); 190dcc8cf2e65d1aa555cce12431a16547e66b469eeSteve Block wrapper.Clear(); 191d0825bca7fe65beaee391d30da42e937db621564Steve Block } 192dcc8cf2e65d1aa555cce12431a16547e66b469eeSteve Block m_wrapperBoilerplates.clear(); 193d0825bca7fe65beaee391d30da42e937db621564Steve Block} 194d0825bca7fe65beaee391d30da42e937db621564Steve Block 195d0825bca7fe65beaee391d30da42e937db621564Steve Blockvoid V8DOMWindowShell::destroyGlobal() 196d0825bca7fe65beaee391d30da42e937db621564Steve Block{ 197d0825bca7fe65beaee391d30da42e937db621564Steve Block if (!m_global.IsEmpty()) { 198d0825bca7fe65beaee391d30da42e937db621564Steve Block#ifndef NDEBUG 199d0825bca7fe65beaee391d30da42e937db621564Steve Block V8GCController::unregisterGlobalHandle(this, m_global); 200d0825bca7fe65beaee391d30da42e937db621564Steve Block#endif 201d0825bca7fe65beaee391d30da42e937db621564Steve Block m_global.Dispose(); 202d0825bca7fe65beaee391d30da42e937db621564Steve Block m_global.Clear(); 203d0825bca7fe65beaee391d30da42e937db621564Steve Block } 204d0825bca7fe65beaee391d30da42e937db621564Steve Block} 205d0825bca7fe65beaee391d30da42e937db621564Steve Block 206d0825bca7fe65beaee391d30da42e937db621564Steve Blockvoid V8DOMWindowShell::clearForClose() 207d0825bca7fe65beaee391d30da42e937db621564Steve Block{ 208d0825bca7fe65beaee391d30da42e937db621564Steve Block if (!m_context.IsEmpty()) { 209d0825bca7fe65beaee391d30da42e937db621564Steve Block v8::HandleScope handleScope; 210d0825bca7fe65beaee391d30da42e937db621564Steve Block 211d0825bca7fe65beaee391d30da42e937db621564Steve Block clearDocumentWrapper(); 212d0825bca7fe65beaee391d30da42e937db621564Steve Block disposeContextHandles(); 213d0825bca7fe65beaee391d30da42e937db621564Steve Block } 214d0825bca7fe65beaee391d30da42e937db621564Steve Block} 215d0825bca7fe65beaee391d30da42e937db621564Steve Block 216d0825bca7fe65beaee391d30da42e937db621564Steve Blockvoid V8DOMWindowShell::clearForNavigation() 217d0825bca7fe65beaee391d30da42e937db621564Steve Block{ 218d0825bca7fe65beaee391d30da42e937db621564Steve Block if (!m_context.IsEmpty()) { 219d0825bca7fe65beaee391d30da42e937db621564Steve Block v8::HandleScope handle; 220d0825bca7fe65beaee391d30da42e937db621564Steve Block clearDocumentWrapper(); 221d0825bca7fe65beaee391d30da42e937db621564Steve Block 222d0825bca7fe65beaee391d30da42e937db621564Steve Block v8::Context::Scope contextScope(m_context); 223d0825bca7fe65beaee391d30da42e937db621564Steve Block 224d0825bca7fe65beaee391d30da42e937db621564Steve Block // Clear the document wrapper cache before turning on access checks on 225d0825bca7fe65beaee391d30da42e937db621564Steve Block // the old DOMWindow wrapper. This way, access to the document wrapper 226d0825bca7fe65beaee391d30da42e937db621564Steve Block // will be protected by the security checks on the DOMWindow wrapper. 227d0825bca7fe65beaee391d30da42e937db621564Steve Block clearDocumentWrapperCache(); 228d0825bca7fe65beaee391d30da42e937db621564Steve Block 229d0825bca7fe65beaee391d30da42e937db621564Steve Block // Turn on access check on the old DOMWindow wrapper. 2308a0914b749bbe7da7768e07a7db5c6d4bb09472bSteve Block v8::Handle<v8::Object> wrapper = V8DOMWrapper::lookupDOMWrapper(V8DOMWindow::GetTemplate(), m_global); 231d0825bca7fe65beaee391d30da42e937db621564Steve Block ASSERT(!wrapper.IsEmpty()); 232d0825bca7fe65beaee391d30da42e937db621564Steve Block wrapper->TurnOnAccessCheck(); 233d0825bca7fe65beaee391d30da42e937db621564Steve Block 234d0825bca7fe65beaee391d30da42e937db621564Steve Block // Separate the context from its global object. 235d0825bca7fe65beaee391d30da42e937db621564Steve Block m_context->DetachGlobal(); 236d0825bca7fe65beaee391d30da42e937db621564Steve Block 237d0825bca7fe65beaee391d30da42e937db621564Steve Block disposeContextHandles(); 238d0825bca7fe65beaee391d30da42e937db621564Steve Block } 239d0825bca7fe65beaee391d30da42e937db621564Steve Block} 240d0825bca7fe65beaee391d30da42e937db621564Steve Block 241d0825bca7fe65beaee391d30da42e937db621564Steve Block// Create a new environment and setup the global object. 242d0825bca7fe65beaee391d30da42e937db621564Steve Block// 243d0825bca7fe65beaee391d30da42e937db621564Steve Block// The global object corresponds to a DOMWindow instance. However, to 244d0825bca7fe65beaee391d30da42e937db621564Steve Block// allow properties of the JS DOMWindow instance to be shadowed, we 245d0825bca7fe65beaee391d30da42e937db621564Steve Block// use a shadow object as the global object and use the JS DOMWindow 246d0825bca7fe65beaee391d30da42e937db621564Steve Block// instance as the prototype for that shadow object. The JS DOMWindow 247d0825bca7fe65beaee391d30da42e937db621564Steve Block// instance is undetectable from javascript code because the __proto__ 248d0825bca7fe65beaee391d30da42e937db621564Steve Block// accessors skip that object. 249d0825bca7fe65beaee391d30da42e937db621564Steve Block// 250d0825bca7fe65beaee391d30da42e937db621564Steve Block// The shadow object and the DOMWindow instance are seen as one object 251d0825bca7fe65beaee391d30da42e937db621564Steve Block// from javascript. The javascript object that corresponds to a 252d0825bca7fe65beaee391d30da42e937db621564Steve Block// DOMWindow instance is the shadow object. When mapping a DOMWindow 253d0825bca7fe65beaee391d30da42e937db621564Steve Block// instance to a V8 object, we return the shadow object. 254d0825bca7fe65beaee391d30da42e937db621564Steve Block// 255d0825bca7fe65beaee391d30da42e937db621564Steve Block// To implement split-window, see 256d0825bca7fe65beaee391d30da42e937db621564Steve Block// 1) https://bugs.webkit.org/show_bug.cgi?id=17249 257d0825bca7fe65beaee391d30da42e937db621564Steve Block// 2) https://wiki.mozilla.org/Gecko:SplitWindow 258d0825bca7fe65beaee391d30da42e937db621564Steve Block// 3) https://bugzilla.mozilla.org/show_bug.cgi?id=296639 259d0825bca7fe65beaee391d30da42e937db621564Steve Block// we need to split the shadow object further into two objects: 260d0825bca7fe65beaee391d30da42e937db621564Steve Block// an outer window and an inner window. The inner window is the hidden 261d0825bca7fe65beaee391d30da42e937db621564Steve Block// prototype of the outer window. The inner window is the default 262d0825bca7fe65beaee391d30da42e937db621564Steve Block// global object of the context. A variable declared in the global 263d0825bca7fe65beaee391d30da42e937db621564Steve Block// scope is a property of the inner window. 264d0825bca7fe65beaee391d30da42e937db621564Steve Block// 265d0825bca7fe65beaee391d30da42e937db621564Steve Block// The outer window sticks to a Frame, it is exposed to JavaScript 266d0825bca7fe65beaee391d30da42e937db621564Steve Block// via window.window, window.self, window.parent, etc. The outer window 267d0825bca7fe65beaee391d30da42e937db621564Steve Block// has a security token which is the domain. The outer window cannot 268d0825bca7fe65beaee391d30da42e937db621564Steve Block// have its own properties. window.foo = 'x' is delegated to the 269d0825bca7fe65beaee391d30da42e937db621564Steve Block// inner window. 270d0825bca7fe65beaee391d30da42e937db621564Steve Block// 271d0825bca7fe65beaee391d30da42e937db621564Steve Block// When a frame navigates to a new page, the inner window is cut off 272d0825bca7fe65beaee391d30da42e937db621564Steve Block// the outer window, and the outer window identify is preserved for 273d0825bca7fe65beaee391d30da42e937db621564Steve Block// the frame. However, a new inner window is created for the new page. 274d0825bca7fe65beaee391d30da42e937db621564Steve Block// If there are JS code holds a closure to the old inner window, 275d0825bca7fe65beaee391d30da42e937db621564Steve Block// it won't be able to reach the outer window via its global object. 2765abb8606fa57c3ebfc8b3c3dbc3fa4a25d2ae306Iain Merrickbool V8DOMWindowShell::initContextIfNeeded() 277d0825bca7fe65beaee391d30da42e937db621564Steve Block{ 278d0825bca7fe65beaee391d30da42e937db621564Steve Block // Bail out if the context has already been initialized. 279d0825bca7fe65beaee391d30da42e937db621564Steve Block if (!m_context.IsEmpty()) 2805abb8606fa57c3ebfc8b3c3dbc3fa4a25d2ae306Iain Merrick return false; 281d0825bca7fe65beaee391d30da42e937db621564Steve Block 282d0825bca7fe65beaee391d30da42e937db621564Steve Block // Create a handle scope for all local handles. 283d0825bca7fe65beaee391d30da42e937db621564Steve Block v8::HandleScope handleScope; 284d0825bca7fe65beaee391d30da42e937db621564Steve Block 285d0825bca7fe65beaee391d30da42e937db621564Steve Block // Setup the security handlers and message listener. This only has 286d0825bca7fe65beaee391d30da42e937db621564Steve Block // to be done once. 287d0825bca7fe65beaee391d30da42e937db621564Steve Block static bool isV8Initialized = false; 288d0825bca7fe65beaee391d30da42e937db621564Steve Block if (!isV8Initialized) { 289d0825bca7fe65beaee391d30da42e937db621564Steve Block // Tells V8 not to call the default OOM handler, binding code 290d0825bca7fe65beaee391d30da42e937db621564Steve Block // will handle it. 291d0825bca7fe65beaee391d30da42e937db621564Steve Block v8::V8::IgnoreOutOfMemoryException(); 292d0825bca7fe65beaee391d30da42e937db621564Steve Block v8::V8::SetFatalErrorHandler(reportFatalErrorInV8); 293d0825bca7fe65beaee391d30da42e937db621564Steve Block 294d0825bca7fe65beaee391d30da42e937db621564Steve Block v8::V8::SetGlobalGCPrologueCallback(&V8GCController::gcPrologue); 295d0825bca7fe65beaee391d30da42e937db621564Steve Block v8::V8::SetGlobalGCEpilogueCallback(&V8GCController::gcEpilogue); 296d0825bca7fe65beaee391d30da42e937db621564Steve Block 297ab9e7a118cf1ea2e3a93dce683b2ded3e7291ddbBen Murdoch v8::V8::AddMessageListener(&v8UncaughtExceptionHandler); 298d0825bca7fe65beaee391d30da42e937db621564Steve Block 299d0825bca7fe65beaee391d30da42e937db621564Steve Block v8::V8::SetFailedAccessCheckCallbackFunction(reportUnsafeJavaScriptAccess); 300d0825bca7fe65beaee391d30da42e937db621564Steve Block 3012bde8e466a4451c7319e3a072d118917957d6554Steve Block ScriptProfiler::initialize(); 3022bde8e466a4451c7319e3a072d118917957d6554Steve Block 303d0825bca7fe65beaee391d30da42e937db621564Steve Block isV8Initialized = true; 304d0825bca7fe65beaee391d30da42e937db621564Steve Block } 305d0825bca7fe65beaee391d30da42e937db621564Steve Block 306d0825bca7fe65beaee391d30da42e937db621564Steve Block 307d0825bca7fe65beaee391d30da42e937db621564Steve Block m_context = createNewContext(m_global, 0); 308d0825bca7fe65beaee391d30da42e937db621564Steve Block if (m_context.IsEmpty()) 3095abb8606fa57c3ebfc8b3c3dbc3fa4a25d2ae306Iain Merrick return false; 310d0825bca7fe65beaee391d30da42e937db621564Steve Block 311d0825bca7fe65beaee391d30da42e937db621564Steve Block v8::Local<v8::Context> v8Context = v8::Local<v8::Context>::New(m_context); 312d0825bca7fe65beaee391d30da42e937db621564Steve Block v8::Context::Scope contextScope(v8Context); 313d0825bca7fe65beaee391d30da42e937db621564Steve Block 314d0825bca7fe65beaee391d30da42e937db621564Steve Block // Store the first global object created so we can reuse it. 315d0825bca7fe65beaee391d30da42e937db621564Steve Block if (m_global.IsEmpty()) { 316d0825bca7fe65beaee391d30da42e937db621564Steve Block m_global = v8::Persistent<v8::Object>::New(v8Context->Global()); 317d0825bca7fe65beaee391d30da42e937db621564Steve Block // Bail out if allocation of the first global objects fails. 318d0825bca7fe65beaee391d30da42e937db621564Steve Block if (m_global.IsEmpty()) { 319d0825bca7fe65beaee391d30da42e937db621564Steve Block disposeContextHandles(); 3205abb8606fa57c3ebfc8b3c3dbc3fa4a25d2ae306Iain Merrick return false; 321d0825bca7fe65beaee391d30da42e937db621564Steve Block } 322d0825bca7fe65beaee391d30da42e937db621564Steve Block#ifndef NDEBUG 323d0825bca7fe65beaee391d30da42e937db621564Steve Block V8GCController::registerGlobalHandle(PROXY, this, m_global); 324d0825bca7fe65beaee391d30da42e937db621564Steve Block#endif 325d0825bca7fe65beaee391d30da42e937db621564Steve Block } 326d0825bca7fe65beaee391d30da42e937db621564Steve Block 327dcc8cf2e65d1aa555cce12431a16547e66b469eeSteve Block if (!installHiddenObjectPrototype(v8Context)) { 328d0825bca7fe65beaee391d30da42e937db621564Steve Block disposeContextHandles(); 3295abb8606fa57c3ebfc8b3c3dbc3fa4a25d2ae306Iain Merrick return false; 330d0825bca7fe65beaee391d30da42e937db621564Steve Block } 331d0825bca7fe65beaee391d30da42e937db621564Steve Block 332dcc8cf2e65d1aa555cce12431a16547e66b469eeSteve Block if (!installDOMWindow(v8Context, m_frame->domWindow())) { 333d0825bca7fe65beaee391d30da42e937db621564Steve Block disposeContextHandles(); 3345abb8606fa57c3ebfc8b3c3dbc3fa4a25d2ae306Iain Merrick return false; 335dcc8cf2e65d1aa555cce12431a16547e66b469eeSteve Block } 336d0825bca7fe65beaee391d30da42e937db621564Steve Block 337d0825bca7fe65beaee391d30da42e937db621564Steve Block updateDocument(); 338d0825bca7fe65beaee391d30da42e937db621564Steve Block 339d0825bca7fe65beaee391d30da42e937db621564Steve Block setSecurityToken(); 340d0825bca7fe65beaee391d30da42e937db621564Steve Block 341d0825bca7fe65beaee391d30da42e937db621564Steve Block m_frame->loader()->client()->didCreateScriptContextForFrame(); 342d0825bca7fe65beaee391d30da42e937db621564Steve Block 343d0825bca7fe65beaee391d30da42e937db621564Steve Block // FIXME: This is wrong. We should actually do this for the proper world once 344d0825bca7fe65beaee391d30da42e937db621564Steve Block // we do isolated worlds the WebCore way. 345d0825bca7fe65beaee391d30da42e937db621564Steve Block m_frame->loader()->dispatchDidClearWindowObjectInWorld(0); 34691f28d81678b7c10358c9352239d6fb5cffb9550Steve Block 3475abb8606fa57c3ebfc8b3c3dbc3fa4a25d2ae306Iain Merrick return true; 348d0825bca7fe65beaee391d30da42e937db621564Steve Block} 349d0825bca7fe65beaee391d30da42e937db621564Steve Block 350d0825bca7fe65beaee391d30da42e937db621564Steve Blockv8::Persistent<v8::Context> V8DOMWindowShell::createNewContext(v8::Handle<v8::Object> global, int extensionGroup) 351d0825bca7fe65beaee391d30da42e937db621564Steve Block{ 352d0825bca7fe65beaee391d30da42e937db621564Steve Block v8::Persistent<v8::Context> result; 353d0825bca7fe65beaee391d30da42e937db621564Steve Block 354d0825bca7fe65beaee391d30da42e937db621564Steve Block // The activeDocumentLoader pointer could be 0 during frame shutdown. 355d0825bca7fe65beaee391d30da42e937db621564Steve Block if (!m_frame->loader()->activeDocumentLoader()) 356d0825bca7fe65beaee391d30da42e937db621564Steve Block return result; 357d0825bca7fe65beaee391d30da42e937db621564Steve Block 358d0825bca7fe65beaee391d30da42e937db621564Steve Block // Create a new environment using an empty template for the shadow 359d0825bca7fe65beaee391d30da42e937db621564Steve Block // object. Reuse the global object if one has been created earlier. 360d0825bca7fe65beaee391d30da42e937db621564Steve Block v8::Persistent<v8::ObjectTemplate> globalTemplate = V8DOMWindow::GetShadowObjectTemplate(); 361d0825bca7fe65beaee391d30da42e937db621564Steve Block if (globalTemplate.IsEmpty()) 362d0825bca7fe65beaee391d30da42e937db621564Steve Block return result; 363d0825bca7fe65beaee391d30da42e937db621564Steve Block 364d0825bca7fe65beaee391d30da42e937db621564Steve Block // Used to avoid sleep calls in unload handlers. 365d0825bca7fe65beaee391d30da42e937db621564Steve Block if (!V8Proxy::registeredExtensionWithV8(DateExtension::get())) 366a94275402997c11dd2e778633dacf4b7e630a35dBen Murdoch V8Proxy::registerExtension(DateExtension::get()); 367d0825bca7fe65beaee391d30da42e937db621564Steve Block 3682fc2651226baac27029e38c9d6ef883fa32084dbSteve Block#if ENABLE(JAVASCRIPT_I18N_API) 3692fc2651226baac27029e38c9d6ef883fa32084dbSteve Block // Enables experimental i18n API in V8. 3702fc2651226baac27029e38c9d6ef883fa32084dbSteve Block if (RuntimeEnabledFeatures::javaScriptI18NAPIEnabled() && !V8Proxy::registeredExtensionWithV8(v8::internal::I18NExtension::get())) 3712fc2651226baac27029e38c9d6ef883fa32084dbSteve Block V8Proxy::registerExtension(v8::internal::I18NExtension::get()); 3722fc2651226baac27029e38c9d6ef883fa32084dbSteve Block#endif 3732fc2651226baac27029e38c9d6ef883fa32084dbSteve Block 374d0825bca7fe65beaee391d30da42e937db621564Steve Block // Dynamically tell v8 about our extensions now. 375d0825bca7fe65beaee391d30da42e937db621564Steve Block const V8Extensions& extensions = V8Proxy::extensions(); 3762fc2651226baac27029e38c9d6ef883fa32084dbSteve Block OwnArrayPtr<const char*> extensionNames = adoptArrayPtr(new const char*[extensions.size()]); 377d0825bca7fe65beaee391d30da42e937db621564Steve Block int index = 0; 378d0825bca7fe65beaee391d30da42e937db621564Steve Block for (size_t i = 0; i < extensions.size(); ++i) { 379a94275402997c11dd2e778633dacf4b7e630a35dBen Murdoch // Ensure our date extension is always allowed. 380a94275402997c11dd2e778633dacf4b7e630a35dBen Murdoch if (extensions[i] != DateExtension::get() 381a94275402997c11dd2e778633dacf4b7e630a35dBen Murdoch && !m_frame->loader()->client()->allowScriptExtension(extensions[i]->name(), extensionGroup)) 382d0825bca7fe65beaee391d30da42e937db621564Steve Block continue; 383d0825bca7fe65beaee391d30da42e937db621564Steve Block 384a94275402997c11dd2e778633dacf4b7e630a35dBen Murdoch extensionNames[index++] = extensions[i]->name(); 385d0825bca7fe65beaee391d30da42e937db621564Steve Block } 386d0825bca7fe65beaee391d30da42e937db621564Steve Block v8::ExtensionConfiguration extensionConfiguration(index, extensionNames.get()); 387d0825bca7fe65beaee391d30da42e937db621564Steve Block result = v8::Context::New(&extensionConfiguration, globalTemplate, global); 388d0825bca7fe65beaee391d30da42e937db621564Steve Block 389d0825bca7fe65beaee391d30da42e937db621564Steve Block return result; 390d0825bca7fe65beaee391d30da42e937db621564Steve Block} 391d0825bca7fe65beaee391d30da42e937db621564Steve Block 3928fecd9c9a62aa89fb44ed3142ba583dc7b8cbe29Andrei Popescuvoid V8DOMWindowShell::setContext(v8::Handle<v8::Context> context) 393d0825bca7fe65beaee391d30da42e937db621564Steve Block{ 394dcc8cf2e65d1aa555cce12431a16547e66b469eeSteve Block // if we already have a context, clear it before setting the new one. 395dcc8cf2e65d1aa555cce12431a16547e66b469eeSteve Block if (!m_context.IsEmpty()) { 396dcc8cf2e65d1aa555cce12431a16547e66b469eeSteve Block m_context.Dispose(); 397dcc8cf2e65d1aa555cce12431a16547e66b469eeSteve Block m_context.Clear(); 398dcc8cf2e65d1aa555cce12431a16547e66b469eeSteve Block } 399dcc8cf2e65d1aa555cce12431a16547e66b469eeSteve Block m_context = v8::Persistent<v8::Context>::New(context); 400dcc8cf2e65d1aa555cce12431a16547e66b469eeSteve Block} 401d0825bca7fe65beaee391d30da42e937db621564Steve Block 402dcc8cf2e65d1aa555cce12431a16547e66b469eeSteve Blockbool V8DOMWindowShell::installDOMWindow(v8::Handle<v8::Context> context, DOMWindow* window) 403dcc8cf2e65d1aa555cce12431a16547e66b469eeSteve Block{ 404d0825bca7fe65beaee391d30da42e937db621564Steve Block // Create a new JS window object and use it as the prototype for the shadow global object. 405dcc8cf2e65d1aa555cce12431a16547e66b469eeSteve Block v8::Handle<v8::Function> windowConstructor = V8DOMWrapper::getConstructor(&V8DOMWindow::info, getHiddenObjectPrototype(context)); 406d0825bca7fe65beaee391d30da42e937db621564Steve Block v8::Local<v8::Object> jsWindow = SafeAllocation::newInstance(windowConstructor); 407d0825bca7fe65beaee391d30da42e937db621564Steve Block // Bail out if allocation failed. 408d0825bca7fe65beaee391d30da42e937db621564Steve Block if (jsWindow.IsEmpty()) 409d0825bca7fe65beaee391d30da42e937db621564Steve Block return false; 410d0825bca7fe65beaee391d30da42e937db621564Steve Block 411d0825bca7fe65beaee391d30da42e937db621564Steve Block // Wrap the window. 412dcc8cf2e65d1aa555cce12431a16547e66b469eeSteve Block V8DOMWrapper::setDOMWrapper(jsWindow, &V8DOMWindow::info, window); 413dcc8cf2e65d1aa555cce12431a16547e66b469eeSteve Block V8DOMWrapper::setDOMWrapper(v8::Handle<v8::Object>::Cast(jsWindow->GetPrototype()), &V8DOMWindow::info, window); 414d0825bca7fe65beaee391d30da42e937db621564Steve Block 415d0825bca7fe65beaee391d30da42e937db621564Steve Block window->ref(); 416d0825bca7fe65beaee391d30da42e937db621564Steve Block V8DOMWrapper::setJSWrapperForDOMObject(window, v8::Persistent<v8::Object>::New(jsWindow)); 417d0825bca7fe65beaee391d30da42e937db621564Steve Block 418d0825bca7fe65beaee391d30da42e937db621564Steve Block // Insert the window instance as the prototype of the shadow object. 419dcc8cf2e65d1aa555cce12431a16547e66b469eeSteve Block v8::Handle<v8::Object> v8RealGlobal = v8::Handle<v8::Object>::Cast(context->Global()->GetPrototype()); 420dcc8cf2e65d1aa555cce12431a16547e66b469eeSteve Block V8DOMWrapper::setDOMWrapper(v8RealGlobal, &V8DOMWindow::info, window); 421dcc8cf2e65d1aa555cce12431a16547e66b469eeSteve Block v8RealGlobal->SetPrototype(jsWindow); 422d0825bca7fe65beaee391d30da42e937db621564Steve Block return true; 423d0825bca7fe65beaee391d30da42e937db621564Steve Block} 424d0825bca7fe65beaee391d30da42e937db621564Steve Block 4258a0914b749bbe7da7768e07a7db5c6d4bb09472bSteve Blockvoid V8DOMWindowShell::updateDocumentWrapper(v8::Handle<v8::Object> wrapper) 426d0825bca7fe65beaee391d30da42e937db621564Steve Block{ 427d0825bca7fe65beaee391d30da42e937db621564Steve Block clearDocumentWrapper(); 428d0825bca7fe65beaee391d30da42e937db621564Steve Block 429d0825bca7fe65beaee391d30da42e937db621564Steve Block ASSERT(m_document.IsEmpty()); 4308a0914b749bbe7da7768e07a7db5c6d4bb09472bSteve Block m_document = v8::Persistent<v8::Object>::New(wrapper); 431d0825bca7fe65beaee391d30da42e937db621564Steve Block#ifndef NDEBUG 432d0825bca7fe65beaee391d30da42e937db621564Steve Block V8GCController::registerGlobalHandle(PROXY, this, m_document); 433d0825bca7fe65beaee391d30da42e937db621564Steve Block#endif 434d0825bca7fe65beaee391d30da42e937db621564Steve Block} 435d0825bca7fe65beaee391d30da42e937db621564Steve Block 436d0825bca7fe65beaee391d30da42e937db621564Steve Blockvoid V8DOMWindowShell::clearDocumentWrapper() 437d0825bca7fe65beaee391d30da42e937db621564Steve Block{ 438d0825bca7fe65beaee391d30da42e937db621564Steve Block if (!m_document.IsEmpty()) { 439d0825bca7fe65beaee391d30da42e937db621564Steve Block#ifndef NDEBUG 440d0825bca7fe65beaee391d30da42e937db621564Steve Block V8GCController::unregisterGlobalHandle(this, m_document); 441d0825bca7fe65beaee391d30da42e937db621564Steve Block#endif 442d0825bca7fe65beaee391d30da42e937db621564Steve Block m_document.Dispose(); 443d0825bca7fe65beaee391d30da42e937db621564Steve Block m_document.Clear(); 444d0825bca7fe65beaee391d30da42e937db621564Steve Block } 445d0825bca7fe65beaee391d30da42e937db621564Steve Block} 446d0825bca7fe65beaee391d30da42e937db621564Steve Block 447f486d19d62f1bc33246748b14b14a9dfa617b57fIain Merrickstatic void checkDocumentWrapper(v8::Handle<v8::Object> wrapper, Document* document) 448f486d19d62f1bc33246748b14b14a9dfa617b57fIain Merrick{ 449f486d19d62f1bc33246748b14b14a9dfa617b57fIain Merrick ASSERT(V8Document::toNative(wrapper) == document); 450f486d19d62f1bc33246748b14b14a9dfa617b57fIain Merrick ASSERT(!document->isHTMLDocument() || (V8Document::toNative(v8::Handle<v8::Object>::Cast(wrapper->GetPrototype())) == document)); 451f486d19d62f1bc33246748b14b14a9dfa617b57fIain Merrick} 452f486d19d62f1bc33246748b14b14a9dfa617b57fIain Merrick 453d0825bca7fe65beaee391d30da42e937db621564Steve Blockvoid V8DOMWindowShell::updateDocumentWrapperCache() 454d0825bca7fe65beaee391d30da42e937db621564Steve Block{ 455d0825bca7fe65beaee391d30da42e937db621564Steve Block v8::HandleScope handleScope; 456d0825bca7fe65beaee391d30da42e937db621564Steve Block v8::Context::Scope contextScope(m_context); 457d0825bca7fe65beaee391d30da42e937db621564Steve Block 458d0825bca7fe65beaee391d30da42e937db621564Steve Block // If the document has no frame, NodeToV8Object might get the 459d0825bca7fe65beaee391d30da42e937db621564Steve Block // document wrapper for a document that is about to be deleted. 460d0825bca7fe65beaee391d30da42e937db621564Steve Block // If the ForceSet below causes a garbage collection, the document 461d0825bca7fe65beaee391d30da42e937db621564Steve Block // might get deleted and the global handle for the document 462d0825bca7fe65beaee391d30da42e937db621564Steve Block // wrapper cleared. Using the cleared global handle will lead to 463d0825bca7fe65beaee391d30da42e937db621564Steve Block // crashes. In this case we clear the cache and let the DOMWindow 464d0825bca7fe65beaee391d30da42e937db621564Steve Block // accessor handle access to the document. 465d0825bca7fe65beaee391d30da42e937db621564Steve Block if (!m_frame->document()->frame()) { 466d0825bca7fe65beaee391d30da42e937db621564Steve Block clearDocumentWrapperCache(); 467d0825bca7fe65beaee391d30da42e937db621564Steve Block return; 468d0825bca7fe65beaee391d30da42e937db621564Steve Block } 469d0825bca7fe65beaee391d30da42e937db621564Steve Block 4705e2bc6953fe6923165b8a5d7679939693a1d58d6Steve Block v8::Handle<v8::Value> documentWrapper = toV8(m_frame->document()); 471f486d19d62f1bc33246748b14b14a9dfa617b57fIain Merrick ASSERT(documentWrapper == m_document || m_document.IsEmpty()); 472f486d19d62f1bc33246748b14b14a9dfa617b57fIain Merrick if (m_document.IsEmpty()) 473f486d19d62f1bc33246748b14b14a9dfa617b57fIain Merrick updateDocumentWrapper(v8::Handle<v8::Object>::Cast(documentWrapper)); 474f486d19d62f1bc33246748b14b14a9dfa617b57fIain Merrick checkDocumentWrapper(m_document, m_frame->document()); 475d0825bca7fe65beaee391d30da42e937db621564Steve Block 476d0825bca7fe65beaee391d30da42e937db621564Steve Block // If instantiation of the document wrapper fails, clear the cache 477d0825bca7fe65beaee391d30da42e937db621564Steve Block // and let the DOMWindow accessor handle access to the document. 478d0825bca7fe65beaee391d30da42e937db621564Steve Block if (documentWrapper.IsEmpty()) { 479d0825bca7fe65beaee391d30da42e937db621564Steve Block clearDocumentWrapperCache(); 480d0825bca7fe65beaee391d30da42e937db621564Steve Block return; 481d0825bca7fe65beaee391d30da42e937db621564Steve Block } 4828a0914b749bbe7da7768e07a7db5c6d4bb09472bSteve Block ASSERT(documentWrapper->IsObject()); 483d0825bca7fe65beaee391d30da42e937db621564Steve Block m_context->Global()->ForceSet(v8::String::New("document"), documentWrapper, static_cast<v8::PropertyAttribute>(v8::ReadOnly | v8::DontDelete)); 484d0825bca7fe65beaee391d30da42e937db621564Steve Block} 485d0825bca7fe65beaee391d30da42e937db621564Steve Block 486d0825bca7fe65beaee391d30da42e937db621564Steve Blockvoid V8DOMWindowShell::clearDocumentWrapperCache() 487d0825bca7fe65beaee391d30da42e937db621564Steve Block{ 488d0825bca7fe65beaee391d30da42e937db621564Steve Block ASSERT(!m_context.IsEmpty()); 489d0825bca7fe65beaee391d30da42e937db621564Steve Block m_context->Global()->ForceDelete(v8::String::New("document")); 490d0825bca7fe65beaee391d30da42e937db621564Steve Block} 491d0825bca7fe65beaee391d30da42e937db621564Steve Block 492d0825bca7fe65beaee391d30da42e937db621564Steve Blockvoid V8DOMWindowShell::setSecurityToken() 493d0825bca7fe65beaee391d30da42e937db621564Steve Block{ 494d0825bca7fe65beaee391d30da42e937db621564Steve Block Document* document = m_frame->document(); 495d0825bca7fe65beaee391d30da42e937db621564Steve Block // Setup security origin and security token. 496d0825bca7fe65beaee391d30da42e937db621564Steve Block if (!document) { 497d0825bca7fe65beaee391d30da42e937db621564Steve Block m_context->UseDefaultSecurityToken(); 498d0825bca7fe65beaee391d30da42e937db621564Steve Block return; 499d0825bca7fe65beaee391d30da42e937db621564Steve Block } 500d0825bca7fe65beaee391d30da42e937db621564Steve Block 501d0825bca7fe65beaee391d30da42e937db621564Steve Block // Ask the document's SecurityOrigin to generate a security token. 502d0825bca7fe65beaee391d30da42e937db621564Steve Block // If two tokens are equal, then the SecurityOrigins canAccess each other. 503d0825bca7fe65beaee391d30da42e937db621564Steve Block // If two tokens are not equal, then we have to call canAccess. 504d0825bca7fe65beaee391d30da42e937db621564Steve Block // Note: we can't use the HTTPOrigin if it was set from the DOM. 505d0825bca7fe65beaee391d30da42e937db621564Steve Block SecurityOrigin* origin = document->securityOrigin(); 506d0825bca7fe65beaee391d30da42e937db621564Steve Block String token; 507d0825bca7fe65beaee391d30da42e937db621564Steve Block if (!origin->domainWasSetInDOM()) 508d0825bca7fe65beaee391d30da42e937db621564Steve Block token = document->securityOrigin()->toString(); 509d0825bca7fe65beaee391d30da42e937db621564Steve Block 510d0825bca7fe65beaee391d30da42e937db621564Steve Block // An empty or "null" token means we always have to call 511d0825bca7fe65beaee391d30da42e937db621564Steve Block // canAccess. The toString method on securityOrigins returns the 512d0825bca7fe65beaee391d30da42e937db621564Steve Block // string "null" for empty security origins and for security 513d0825bca7fe65beaee391d30da42e937db621564Steve Block // origins that should only allow access to themselves. In this 514d0825bca7fe65beaee391d30da42e937db621564Steve Block // case, we use the global object as the security token to avoid 515d0825bca7fe65beaee391d30da42e937db621564Steve Block // calling canAccess when a script accesses its own objects. 516d0825bca7fe65beaee391d30da42e937db621564Steve Block if (token.isEmpty() || token == "null") { 517d0825bca7fe65beaee391d30da42e937db621564Steve Block m_context->UseDefaultSecurityToken(); 518d0825bca7fe65beaee391d30da42e937db621564Steve Block return; 519d0825bca7fe65beaee391d30da42e937db621564Steve Block } 520d0825bca7fe65beaee391d30da42e937db621564Steve Block 521d0825bca7fe65beaee391d30da42e937db621564Steve Block CString utf8Token = token.utf8(); 522d0825bca7fe65beaee391d30da42e937db621564Steve Block // NOTE: V8 does identity comparison in fast path, must use a symbol 523d0825bca7fe65beaee391d30da42e937db621564Steve Block // as the security token. 524d0825bca7fe65beaee391d30da42e937db621564Steve Block m_context->SetSecurityToken(v8::String::NewSymbol(utf8Token.data(), utf8Token.length())); 525d0825bca7fe65beaee391d30da42e937db621564Steve Block} 526d0825bca7fe65beaee391d30da42e937db621564Steve Block 527d0825bca7fe65beaee391d30da42e937db621564Steve Blockvoid V8DOMWindowShell::updateDocument() 528d0825bca7fe65beaee391d30da42e937db621564Steve Block{ 529d0825bca7fe65beaee391d30da42e937db621564Steve Block if (!m_frame->document()) 530d0825bca7fe65beaee391d30da42e937db621564Steve Block return; 531d0825bca7fe65beaee391d30da42e937db621564Steve Block 532d0825bca7fe65beaee391d30da42e937db621564Steve Block if (m_global.IsEmpty()) 533d0825bca7fe65beaee391d30da42e937db621564Steve Block return; 534d0825bca7fe65beaee391d30da42e937db621564Steve Block 535d0825bca7fe65beaee391d30da42e937db621564Steve Block // There is an existing JavaScript wrapper for the global object 536d0825bca7fe65beaee391d30da42e937db621564Steve Block // of this frame. JavaScript code in other frames might hold a 537d0825bca7fe65beaee391d30da42e937db621564Steve Block // reference to this wrapper. We eagerly initialize the JavaScript 538d0825bca7fe65beaee391d30da42e937db621564Steve Block // context for the new document to make property access on the 539d0825bca7fe65beaee391d30da42e937db621564Steve Block // global object wrapper succeed. 540d0825bca7fe65beaee391d30da42e937db621564Steve Block initContextIfNeeded(); 541d0825bca7fe65beaee391d30da42e937db621564Steve Block 542d0825bca7fe65beaee391d30da42e937db621564Steve Block // Bail out if context initialization failed. 543d0825bca7fe65beaee391d30da42e937db621564Steve Block if (m_context.IsEmpty()) 544d0825bca7fe65beaee391d30da42e937db621564Steve Block return; 545d0825bca7fe65beaee391d30da42e937db621564Steve Block 546d0825bca7fe65beaee391d30da42e937db621564Steve Block // We have a new document and we need to update the cache. 547d0825bca7fe65beaee391d30da42e937db621564Steve Block updateDocumentWrapperCache(); 548d0825bca7fe65beaee391d30da42e937db621564Steve Block 549d0825bca7fe65beaee391d30da42e937db621564Steve Block updateSecurityOrigin(); 550d0825bca7fe65beaee391d30da42e937db621564Steve Block} 551d0825bca7fe65beaee391d30da42e937db621564Steve Block 552f486d19d62f1bc33246748b14b14a9dfa617b57fIain Merrickv8::Handle<v8::Value> getter(v8::Local<v8::String> property, const v8::AccessorInfo& info) 553f486d19d62f1bc33246748b14b14a9dfa617b57fIain Merrick{ 554f486d19d62f1bc33246748b14b14a9dfa617b57fIain Merrick // FIXME(antonm): consider passing AtomicStringImpl directly. 555f486d19d62f1bc33246748b14b14a9dfa617b57fIain Merrick AtomicString name = v8StringToAtomicWebCoreString(property); 556f486d19d62f1bc33246748b14b14a9dfa617b57fIain Merrick HTMLDocument* htmlDocument = V8HTMLDocument::toNative(info.Holder()); 557f486d19d62f1bc33246748b14b14a9dfa617b57fIain Merrick ASSERT(htmlDocument); 558f486d19d62f1bc33246748b14b14a9dfa617b57fIain Merrick v8::Handle<v8::Value> result = V8HTMLDocument::GetNamedProperty(htmlDocument, name); 559f486d19d62f1bc33246748b14b14a9dfa617b57fIain Merrick if (!result.IsEmpty()) 560f486d19d62f1bc33246748b14b14a9dfa617b57fIain Merrick return result; 561f486d19d62f1bc33246748b14b14a9dfa617b57fIain Merrick v8::Handle<v8::Value> prototype = info.Holder()->GetPrototype(); 562f486d19d62f1bc33246748b14b14a9dfa617b57fIain Merrick if (prototype->IsObject()) 563f486d19d62f1bc33246748b14b14a9dfa617b57fIain Merrick return prototype.As<v8::Object>()->Get(property); 564f486d19d62f1bc33246748b14b14a9dfa617b57fIain Merrick return v8::Undefined(); 565f486d19d62f1bc33246748b14b14a9dfa617b57fIain Merrick} 566f486d19d62f1bc33246748b14b14a9dfa617b57fIain Merrick 567f486d19d62f1bc33246748b14b14a9dfa617b57fIain Merrickvoid V8DOMWindowShell::namedItemAdded(HTMLDocument* doc, const AtomicString& name) 568f486d19d62f1bc33246748b14b14a9dfa617b57fIain Merrick{ 569f486d19d62f1bc33246748b14b14a9dfa617b57fIain Merrick initContextIfNeeded(); 570f486d19d62f1bc33246748b14b14a9dfa617b57fIain Merrick 571f486d19d62f1bc33246748b14b14a9dfa617b57fIain Merrick v8::HandleScope handleScope; 572f486d19d62f1bc33246748b14b14a9dfa617b57fIain Merrick v8::Context::Scope contextScope(m_context); 573f486d19d62f1bc33246748b14b14a9dfa617b57fIain Merrick 574f486d19d62f1bc33246748b14b14a9dfa617b57fIain Merrick ASSERT(!m_document.IsEmpty()); 575f486d19d62f1bc33246748b14b14a9dfa617b57fIain Merrick checkDocumentWrapper(m_document, doc); 576f486d19d62f1bc33246748b14b14a9dfa617b57fIain Merrick m_document->SetAccessor(v8String(name), getter); 577f486d19d62f1bc33246748b14b14a9dfa617b57fIain Merrick} 578f486d19d62f1bc33246748b14b14a9dfa617b57fIain Merrick 579f486d19d62f1bc33246748b14b14a9dfa617b57fIain Merrickvoid V8DOMWindowShell::namedItemRemoved(HTMLDocument* doc, const AtomicString& name) 580f486d19d62f1bc33246748b14b14a9dfa617b57fIain Merrick{ 581f486d19d62f1bc33246748b14b14a9dfa617b57fIain Merrick} 582f486d19d62f1bc33246748b14b14a9dfa617b57fIain Merrick 583d0825bca7fe65beaee391d30da42e937db621564Steve Blockvoid V8DOMWindowShell::updateSecurityOrigin() 584d0825bca7fe65beaee391d30da42e937db621564Steve Block{ 585d0825bca7fe65beaee391d30da42e937db621564Steve Block v8::HandleScope scope; 586d0825bca7fe65beaee391d30da42e937db621564Steve Block setSecurityToken(); 587d0825bca7fe65beaee391d30da42e937db621564Steve Block} 588d0825bca7fe65beaee391d30da42e937db621564Steve Block 589d0825bca7fe65beaee391d30da42e937db621564Steve Blockv8::Handle<v8::Value> V8DOMWindowShell::getHiddenObjectPrototype(v8::Handle<v8::Context> context) 590d0825bca7fe65beaee391d30da42e937db621564Steve Block{ 591d0825bca7fe65beaee391d30da42e937db621564Steve Block return context->Global()->GetHiddenValue(V8HiddenPropertyName::objectPrototype()); 592d0825bca7fe65beaee391d30da42e937db621564Steve Block} 593d0825bca7fe65beaee391d30da42e937db621564Steve Block 594dcc8cf2e65d1aa555cce12431a16547e66b469eeSteve Blockbool V8DOMWindowShell::installHiddenObjectPrototype(v8::Handle<v8::Context> context) 595d0825bca7fe65beaee391d30da42e937db621564Steve Block{ 596d0825bca7fe65beaee391d30da42e937db621564Steve Block v8::Handle<v8::String> objectString = v8::String::New("Object"); 597d0825bca7fe65beaee391d30da42e937db621564Steve Block v8::Handle<v8::String> prototypeString = v8::String::New("prototype"); 598d0825bca7fe65beaee391d30da42e937db621564Steve Block v8::Handle<v8::String> hiddenObjectPrototypeString = V8HiddenPropertyName::objectPrototype(); 599d0825bca7fe65beaee391d30da42e937db621564Steve Block // Bail out if allocation failed. 600d0825bca7fe65beaee391d30da42e937db621564Steve Block if (objectString.IsEmpty() || prototypeString.IsEmpty() || hiddenObjectPrototypeString.IsEmpty()) 601dcc8cf2e65d1aa555cce12431a16547e66b469eeSteve Block return false; 602d0825bca7fe65beaee391d30da42e937db621564Steve Block 603d0825bca7fe65beaee391d30da42e937db621564Steve Block v8::Handle<v8::Object> object = v8::Handle<v8::Object>::Cast(context->Global()->Get(objectString)); 604dcc8cf2e65d1aa555cce12431a16547e66b469eeSteve Block // Bail out if fetching failed. 605dcc8cf2e65d1aa555cce12431a16547e66b469eeSteve Block if (object.IsEmpty()) 606dcc8cf2e65d1aa555cce12431a16547e66b469eeSteve Block return false; 607d0825bca7fe65beaee391d30da42e937db621564Steve Block v8::Handle<v8::Value> objectPrototype = object->Get(prototypeString); 608dcc8cf2e65d1aa555cce12431a16547e66b469eeSteve Block // Bail out if fetching failed. 609dcc8cf2e65d1aa555cce12431a16547e66b469eeSteve Block if (objectPrototype.IsEmpty()) 610dcc8cf2e65d1aa555cce12431a16547e66b469eeSteve Block return false; 611d0825bca7fe65beaee391d30da42e937db621564Steve Block 612d0825bca7fe65beaee391d30da42e937db621564Steve Block context->Global()->SetHiddenValue(hiddenObjectPrototypeString, objectPrototype); 613dcc8cf2e65d1aa555cce12431a16547e66b469eeSteve Block 614dcc8cf2e65d1aa555cce12431a16547e66b469eeSteve Block return true; 615d0825bca7fe65beaee391d30da42e937db621564Steve Block} 616d0825bca7fe65beaee391d30da42e937db621564Steve Block 617dcc8cf2e65d1aa555cce12431a16547e66b469eeSteve Blockv8::Local<v8::Object> V8DOMWindowShell::createWrapperFromCacheSlowCase(WrapperTypeInfo* type) 618d0825bca7fe65beaee391d30da42e937db621564Steve Block{ 619d0825bca7fe65beaee391d30da42e937db621564Steve Block // Not in cache. 620d0825bca7fe65beaee391d30da42e937db621564Steve Block initContextIfNeeded(); 621d0825bca7fe65beaee391d30da42e937db621564Steve Block v8::Context::Scope scope(m_context); 622d0825bca7fe65beaee391d30da42e937db621564Steve Block v8::Local<v8::Function> function = V8DOMWrapper::getConstructor(type, getHiddenObjectPrototype(m_context)); 623d0825bca7fe65beaee391d30da42e937db621564Steve Block v8::Local<v8::Object> instance = SafeAllocation::newInstance(function); 624d0825bca7fe65beaee391d30da42e937db621564Steve Block if (!instance.IsEmpty()) { 625dcc8cf2e65d1aa555cce12431a16547e66b469eeSteve Block m_wrapperBoilerplates.set(type, v8::Persistent<v8::Object>::New(instance)); 626d0825bca7fe65beaee391d30da42e937db621564Steve Block return instance->Clone(); 627d0825bca7fe65beaee391d30da42e937db621564Steve Block } 628d0825bca7fe65beaee391d30da42e937db621564Steve Block return notHandledByInterceptor(); 629d0825bca7fe65beaee391d30da42e937db621564Steve Block} 630d0825bca7fe65beaee391d30da42e937db621564Steve Block 631cad810f21b803229eb11403f9209855525a25d57Steve Blockvoid V8DOMWindowShell::setLocation(DOMWindow* window, const String& locationString) 632d0825bca7fe65beaee391d30da42e937db621564Steve Block{ 633cad810f21b803229eb11403f9209855525a25d57Steve Block State<V8Binding>* state = V8BindingState::Only(); 634cad810f21b803229eb11403f9209855525a25d57Steve Block window->setLocation(locationString, state->activeWindow(), state->firstWindow()); 635d0825bca7fe65beaee391d30da42e937db621564Steve Block} 636d0825bca7fe65beaee391d30da42e937db621564Steve Block 637d0825bca7fe65beaee391d30da42e937db621564Steve Block} // WebCore 638