V8DOMWindowShell.cpp revision ab9e7a118cf1ea2e3a93dce683b2ded3e7291ddb
1d0825bca7fe65beaee391d30da42e937db621564Steve Block/* 2d0825bca7fe65beaee391d30da42e937db621564Steve Block * Copyright (C) 2008, 2009 Google Inc. All rights reserved. 3d0825bca7fe65beaee391d30da42e937db621564Steve Block * 4d0825bca7fe65beaee391d30da42e937db621564Steve Block * Redistribution and use in source and binary forms, with or without 5d0825bca7fe65beaee391d30da42e937db621564Steve Block * modification, are permitted provided that the following conditions are 6d0825bca7fe65beaee391d30da42e937db621564Steve Block * met: 7d0825bca7fe65beaee391d30da42e937db621564Steve Block * 8d0825bca7fe65beaee391d30da42e937db621564Steve Block * * Redistributions of source code must retain the above copyright 9d0825bca7fe65beaee391d30da42e937db621564Steve Block * notice, this list of conditions and the following disclaimer. 10d0825bca7fe65beaee391d30da42e937db621564Steve Block * * Redistributions in binary form must reproduce the above 11d0825bca7fe65beaee391d30da42e937db621564Steve Block * copyright notice, this list of conditions and the following disclaimer 12d0825bca7fe65beaee391d30da42e937db621564Steve Block * in the documentation and/or other materials provided with the 13d0825bca7fe65beaee391d30da42e937db621564Steve Block * distribution. 14d0825bca7fe65beaee391d30da42e937db621564Steve Block * * Neither the name of Google Inc. nor the names of its 15d0825bca7fe65beaee391d30da42e937db621564Steve Block * contributors may be used to endorse or promote products derived from 16d0825bca7fe65beaee391d30da42e937db621564Steve Block * this software without specific prior written permission. 17d0825bca7fe65beaee391d30da42e937db621564Steve Block * 18d0825bca7fe65beaee391d30da42e937db621564Steve Block * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 19d0825bca7fe65beaee391d30da42e937db621564Steve Block * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT 20d0825bca7fe65beaee391d30da42e937db621564Steve Block * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR 21d0825bca7fe65beaee391d30da42e937db621564Steve Block * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT 22d0825bca7fe65beaee391d30da42e937db621564Steve Block * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, 23d0825bca7fe65beaee391d30da42e937db621564Steve Block * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT 24d0825bca7fe65beaee391d30da42e937db621564Steve Block * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 25d0825bca7fe65beaee391d30da42e937db621564Steve Block * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 26d0825bca7fe65beaee391d30da42e937db621564Steve Block * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 27d0825bca7fe65beaee391d30da42e937db621564Steve Block * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE 28d0825bca7fe65beaee391d30da42e937db621564Steve Block * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 29d0825bca7fe65beaee391d30da42e937db621564Steve Block */ 30d0825bca7fe65beaee391d30da42e937db621564Steve Block 31d0825bca7fe65beaee391d30da42e937db621564Steve Block#include "config.h" 32d0825bca7fe65beaee391d30da42e937db621564Steve Block#include "V8DOMWindowShell.h" 33d0825bca7fe65beaee391d30da42e937db621564Steve Block 34d0825bca7fe65beaee391d30da42e937db621564Steve Block#include "PlatformBridge.h" 35d0825bca7fe65beaee391d30da42e937db621564Steve Block#include "CSSMutableStyleDeclaration.h" 36d0825bca7fe65beaee391d30da42e937db621564Steve Block#include "DateExtension.h" 37d0825bca7fe65beaee391d30da42e937db621564Steve Block#include "DocumentLoader.h" 38d0825bca7fe65beaee391d30da42e937db621564Steve Block#include "Frame.h" 39d0825bca7fe65beaee391d30da42e937db621564Steve Block#include "FrameLoaderClient.h" 40d0825bca7fe65beaee391d30da42e937db621564Steve Block#include "Page.h" 41d0825bca7fe65beaee391d30da42e937db621564Steve Block#include "PageGroup.h" 42ab9e7a118cf1ea2e3a93dce683b2ded3e7291ddbBen Murdoch#include "ScriptCallStack.h" 43ab9e7a118cf1ea2e3a93dce683b2ded3e7291ddbBen Murdoch#include "ScriptCallStackFactory.h" 44d0825bca7fe65beaee391d30da42e937db621564Steve Block#include "ScriptController.h" 45d0825bca7fe65beaee391d30da42e937db621564Steve Block#include "StorageNamespace.h" 46d0825bca7fe65beaee391d30da42e937db621564Steve Block#include "V8Binding.h" 47d0825bca7fe65beaee391d30da42e937db621564Steve Block#include "V8BindingState.h" 48d0825bca7fe65beaee391d30da42e937db621564Steve Block#include "V8Collection.h" 49d0825bca7fe65beaee391d30da42e937db621564Steve Block#include "V8DOMMap.h" 50d0825bca7fe65beaee391d30da42e937db621564Steve Block#include "V8DOMWindow.h" 515e2bc6953fe6923165b8a5d7679939693a1d58d6Steve Block#include "V8Document.h" 52dcc8cf2e65d1aa555cce12431a16547e66b469eeSteve Block#include "V8GCForContextDispose.h" 53f486d19d62f1bc33246748b14b14a9dfa617b57fIain Merrick#include "V8HTMLDocument.h" 54d0825bca7fe65beaee391d30da42e937db621564Steve Block#include "V8HiddenPropertyName.h" 55d0825bca7fe65beaee391d30da42e937db621564Steve Block#include "V8History.h" 56d0825bca7fe65beaee391d30da42e937db621564Steve Block#include "V8Location.h" 57d0825bca7fe65beaee391d30da42e937db621564Steve Block#include "V8Proxy.h" 58d0825bca7fe65beaee391d30da42e937db621564Steve Block#include "WorkerContextExecutionProxy.h" 59d0825bca7fe65beaee391d30da42e937db621564Steve Block 60d0825bca7fe65beaee391d30da42e937db621564Steve Block#include <algorithm> 61d0825bca7fe65beaee391d30da42e937db621564Steve Block#include <stdio.h> 62d0825bca7fe65beaee391d30da42e937db621564Steve Block#include <utility> 63d0825bca7fe65beaee391d30da42e937db621564Steve Block#include <v8-debug.h> 64d0825bca7fe65beaee391d30da42e937db621564Steve Block#include <v8.h> 65d0825bca7fe65beaee391d30da42e937db621564Steve Block#include <wtf/Assertions.h> 66d0825bca7fe65beaee391d30da42e937db621564Steve Block#include <wtf/OwnArrayPtr.h> 67d0825bca7fe65beaee391d30da42e937db621564Steve Block#include <wtf/StdLibExtras.h> 68d0825bca7fe65beaee391d30da42e937db621564Steve Block#include <wtf/StringExtras.h> 69d0825bca7fe65beaee391d30da42e937db621564Steve Block#include <wtf/UnusedParam.h> 70dcc8cf2e65d1aa555cce12431a16547e66b469eeSteve Block#include <wtf/text/CString.h> 71d0825bca7fe65beaee391d30da42e937db621564Steve Block 724526b6115fa4e132102aec80e9da22c0f85288f6Andrei Popescu#ifdef ANDROID_INSTRUMENT 734bbbef2a208187104163ecdbe4278d709dede038Andrei Popescu#include "TimeCounter.h" 744bbbef2a208187104163ecdbe4278d709dede038Andrei Popescu#endif 754bbbef2a208187104163ecdbe4278d709dede038Andrei Popescu 76d0825bca7fe65beaee391d30da42e937db621564Steve Blocknamespace WebCore { 77d0825bca7fe65beaee391d30da42e937db621564Steve Block 78d0825bca7fe65beaee391d30da42e937db621564Steve Blockstatic void handleFatalErrorInV8() 79d0825bca7fe65beaee391d30da42e937db621564Steve Block{ 80d0825bca7fe65beaee391d30da42e937db621564Steve Block // FIXME: We temporarily deal with V8 internal error situations 81d0825bca7fe65beaee391d30da42e937db621564Steve Block // such as out-of-memory by crashing the renderer. 82d0825bca7fe65beaee391d30da42e937db621564Steve Block CRASH(); 83d0825bca7fe65beaee391d30da42e937db621564Steve Block} 84d0825bca7fe65beaee391d30da42e937db621564Steve Block 85d0825bca7fe65beaee391d30da42e937db621564Steve Blockstatic void reportFatalErrorInV8(const char* location, const char* message) 86d0825bca7fe65beaee391d30da42e937db621564Steve Block{ 87d0825bca7fe65beaee391d30da42e937db621564Steve Block // V8 is shutdown, we cannot use V8 api. 88d0825bca7fe65beaee391d30da42e937db621564Steve Block // The only thing we can do is to disable JavaScript. 89d0825bca7fe65beaee391d30da42e937db621564Steve Block // FIXME: clean up V8Proxy and disable JavaScript. 90dd8bb3de4f353a81954234999f1fea748aee2ea9Ben Murdoch int memoryUsageMB = -1; 91dd8bb3de4f353a81954234999f1fea748aee2ea9Ben Murdoch#if PLATFORM(CHROMIUM) 92ab9e7a118cf1ea2e3a93dce683b2ded3e7291ddbBen Murdoch memoryUsageMB = PlatformBridge::actualMemoryUsageMB(); 93dd8bb3de4f353a81954234999f1fea748aee2ea9Ben Murdoch#endif 94dd8bb3de4f353a81954234999f1fea748aee2ea9Ben Murdoch printf("V8 error: %s (%s). Current memory usage: %d MB\n", message, location, memoryUsageMB); 95d0825bca7fe65beaee391d30da42e937db621564Steve Block handleFatalErrorInV8(); 96d0825bca7fe65beaee391d30da42e937db621564Steve Block} 97d0825bca7fe65beaee391d30da42e937db621564Steve Block 98ab9e7a118cf1ea2e3a93dce683b2ded3e7291ddbBen Murdochstatic void v8UncaughtExceptionHandler(v8::Handle<v8::Message> message, v8::Handle<v8::Value> data) 99ab9e7a118cf1ea2e3a93dce683b2ded3e7291ddbBen Murdoch{ 100ab9e7a118cf1ea2e3a93dce683b2ded3e7291ddbBen Murdoch // Use the frame where JavaScript is called from. 101ab9e7a118cf1ea2e3a93dce683b2ded3e7291ddbBen Murdoch Frame* frame = V8Proxy::retrieveFrameForEnteredContext(); 102ab9e7a118cf1ea2e3a93dce683b2ded3e7291ddbBen Murdoch if (!frame) 103ab9e7a118cf1ea2e3a93dce683b2ded3e7291ddbBen Murdoch return; 104ab9e7a118cf1ea2e3a93dce683b2ded3e7291ddbBen Murdoch 105ab9e7a118cf1ea2e3a93dce683b2ded3e7291ddbBen Murdoch v8::Handle<v8::String> errorMessageString = message->Get(); 106ab9e7a118cf1ea2e3a93dce683b2ded3e7291ddbBen Murdoch ASSERT(!errorMessageString.IsEmpty()); 107ab9e7a118cf1ea2e3a93dce683b2ded3e7291ddbBen Murdoch String errorMessage = toWebCoreString(errorMessageString); 108ab9e7a118cf1ea2e3a93dce683b2ded3e7291ddbBen Murdoch 109ab9e7a118cf1ea2e3a93dce683b2ded3e7291ddbBen Murdoch v8::Handle<v8::StackTrace> stackTrace = message->GetStackTrace(); 110ab9e7a118cf1ea2e3a93dce683b2ded3e7291ddbBen Murdoch RefPtr<ScriptCallStack> callStack; 111ab9e7a118cf1ea2e3a93dce683b2ded3e7291ddbBen Murdoch // Currently stack trace is only collected when inspector is open. 112ab9e7a118cf1ea2e3a93dce683b2ded3e7291ddbBen Murdoch if (!stackTrace.IsEmpty() && stackTrace->GetFrameCount() > 0) 113ab9e7a118cf1ea2e3a93dce683b2ded3e7291ddbBen Murdoch callStack = createScriptCallStack(stackTrace, ScriptCallStack::maxCallStackSizeToCapture); 114ab9e7a118cf1ea2e3a93dce683b2ded3e7291ddbBen Murdoch 115ab9e7a118cf1ea2e3a93dce683b2ded3e7291ddbBen Murdoch v8::Handle<v8::Value> resourceName = message->GetScriptResourceName(); 116ab9e7a118cf1ea2e3a93dce683b2ded3e7291ddbBen Murdoch bool useURL = resourceName.IsEmpty() || !resourceName->IsString(); 117ab9e7a118cf1ea2e3a93dce683b2ded3e7291ddbBen Murdoch Document* document = frame->document(); 118ab9e7a118cf1ea2e3a93dce683b2ded3e7291ddbBen Murdoch String resourceNameString = useURL ? document->url() : toWebCoreString(resourceName); 119ab9e7a118cf1ea2e3a93dce683b2ded3e7291ddbBen Murdoch document->reportException(errorMessage, message->GetLineNumber(), resourceNameString, callStack); 120ab9e7a118cf1ea2e3a93dce683b2ded3e7291ddbBen Murdoch} 121ab9e7a118cf1ea2e3a93dce683b2ded3e7291ddbBen Murdoch 122d0825bca7fe65beaee391d30da42e937db621564Steve Block// Returns the owner frame pointer of a DOM wrapper object. It only works for 123d0825bca7fe65beaee391d30da42e937db621564Steve Block// these DOM objects requiring cross-domain access check. 124d0825bca7fe65beaee391d30da42e937db621564Steve Blockstatic Frame* getTargetFrame(v8::Local<v8::Object> host, v8::Local<v8::Value> data) 125d0825bca7fe65beaee391d30da42e937db621564Steve Block{ 126d0825bca7fe65beaee391d30da42e937db621564Steve Block Frame* target = 0; 127dcc8cf2e65d1aa555cce12431a16547e66b469eeSteve Block WrapperTypeInfo* type = WrapperTypeInfo::unwrap(data); 128dcc8cf2e65d1aa555cce12431a16547e66b469eeSteve Block if (V8DOMWindow::info.equals(type)) { 1298a0914b749bbe7da7768e07a7db5c6d4bb09472bSteve Block v8::Handle<v8::Object> window = V8DOMWrapper::lookupDOMWrapper(V8DOMWindow::GetTemplate(), host); 130d0825bca7fe65beaee391d30da42e937db621564Steve Block if (window.IsEmpty()) 131d0825bca7fe65beaee391d30da42e937db621564Steve Block return target; 132d0825bca7fe65beaee391d30da42e937db621564Steve Block 133d0825bca7fe65beaee391d30da42e937db621564Steve Block DOMWindow* targetWindow = V8DOMWindow::toNative(window); 134d0825bca7fe65beaee391d30da42e937db621564Steve Block target = targetWindow->frame(); 135dcc8cf2e65d1aa555cce12431a16547e66b469eeSteve Block } else if (V8History::info.equals(type)) { 136d0825bca7fe65beaee391d30da42e937db621564Steve Block History* history = V8History::toNative(host); 137d0825bca7fe65beaee391d30da42e937db621564Steve Block target = history->frame(); 138dcc8cf2e65d1aa555cce12431a16547e66b469eeSteve Block } else if (V8Location::info.equals(type)) { 139d0825bca7fe65beaee391d30da42e937db621564Steve Block Location* location = V8Location::toNative(host); 140d0825bca7fe65beaee391d30da42e937db621564Steve Block target = location->frame(); 141d0825bca7fe65beaee391d30da42e937db621564Steve Block } 142d0825bca7fe65beaee391d30da42e937db621564Steve Block return target; 143d0825bca7fe65beaee391d30da42e937db621564Steve Block} 144d0825bca7fe65beaee391d30da42e937db621564Steve Block 145d0825bca7fe65beaee391d30da42e937db621564Steve Blockstatic void reportUnsafeJavaScriptAccess(v8::Local<v8::Object> host, v8::AccessType type, v8::Local<v8::Value> data) 146d0825bca7fe65beaee391d30da42e937db621564Steve Block{ 147d0825bca7fe65beaee391d30da42e937db621564Steve Block Frame* target = getTargetFrame(host, data); 148d0825bca7fe65beaee391d30da42e937db621564Steve Block if (target) 149ab9e7a118cf1ea2e3a93dce683b2ded3e7291ddbBen Murdoch V8Proxy::reportUnsafeAccessTo(target); 150d0825bca7fe65beaee391d30da42e937db621564Steve Block} 151d0825bca7fe65beaee391d30da42e937db621564Steve Block 152d0825bca7fe65beaee391d30da42e937db621564Steve BlockPassRefPtr<V8DOMWindowShell> V8DOMWindowShell::create(Frame* frame) 153d0825bca7fe65beaee391d30da42e937db621564Steve Block{ 154d0825bca7fe65beaee391d30da42e937db621564Steve Block return adoptRef(new V8DOMWindowShell(frame)); 155d0825bca7fe65beaee391d30da42e937db621564Steve Block} 156d0825bca7fe65beaee391d30da42e937db621564Steve Block 157d0825bca7fe65beaee391d30da42e937db621564Steve BlockV8DOMWindowShell::V8DOMWindowShell(Frame* frame) 158d0825bca7fe65beaee391d30da42e937db621564Steve Block : m_frame(frame) 159d0825bca7fe65beaee391d30da42e937db621564Steve Block{ 160d0825bca7fe65beaee391d30da42e937db621564Steve Block} 161d0825bca7fe65beaee391d30da42e937db621564Steve Block 162d0825bca7fe65beaee391d30da42e937db621564Steve Blockbool V8DOMWindowShell::isContextInitialized() 163d0825bca7fe65beaee391d30da42e937db621564Steve Block{ 164d0825bca7fe65beaee391d30da42e937db621564Steve Block // m_context, m_global, and m_wrapperBoilerplates should 165d0825bca7fe65beaee391d30da42e937db621564Steve Block // all be non-empty if if m_context is non-empty. 166d0825bca7fe65beaee391d30da42e937db621564Steve Block ASSERT(m_context.IsEmpty() || !m_global.IsEmpty()); 167d0825bca7fe65beaee391d30da42e937db621564Steve Block return !m_context.IsEmpty(); 168d0825bca7fe65beaee391d30da42e937db621564Steve Block} 169d0825bca7fe65beaee391d30da42e937db621564Steve Block 170d0825bca7fe65beaee391d30da42e937db621564Steve Blockvoid V8DOMWindowShell::disposeContextHandles() 171d0825bca7fe65beaee391d30da42e937db621564Steve Block{ 172d0825bca7fe65beaee391d30da42e937db621564Steve Block if (!m_context.IsEmpty()) { 173d0825bca7fe65beaee391d30da42e937db621564Steve Block m_frame->loader()->client()->didDestroyScriptContextForFrame(); 174d0825bca7fe65beaee391d30da42e937db621564Steve Block m_context.Dispose(); 175d0825bca7fe65beaee391d30da42e937db621564Steve Block m_context.Clear(); 176dcc8cf2e65d1aa555cce12431a16547e66b469eeSteve Block 177dcc8cf2e65d1aa555cce12431a16547e66b469eeSteve Block // It's likely that disposing the context has created a lot of 178dcc8cf2e65d1aa555cce12431a16547e66b469eeSteve Block // garbage. Notify V8 about this so it'll have a chance of cleaning 179dcc8cf2e65d1aa555cce12431a16547e66b469eeSteve Block // it up when idle. 180dcc8cf2e65d1aa555cce12431a16547e66b469eeSteve Block V8GCForContextDispose::instance().notifyContextDisposed(); 181d0825bca7fe65beaee391d30da42e937db621564Steve Block } 182d0825bca7fe65beaee391d30da42e937db621564Steve Block 183dcc8cf2e65d1aa555cce12431a16547e66b469eeSteve Block WrapperBoilerplateMap::iterator it = m_wrapperBoilerplates.begin(); 184dcc8cf2e65d1aa555cce12431a16547e66b469eeSteve Block for (; it != m_wrapperBoilerplates.end(); ++it) { 185dcc8cf2e65d1aa555cce12431a16547e66b469eeSteve Block v8::Persistent<v8::Object> wrapper = it->second; 186dcc8cf2e65d1aa555cce12431a16547e66b469eeSteve Block wrapper.Dispose(); 187dcc8cf2e65d1aa555cce12431a16547e66b469eeSteve Block wrapper.Clear(); 188d0825bca7fe65beaee391d30da42e937db621564Steve Block } 189dcc8cf2e65d1aa555cce12431a16547e66b469eeSteve Block m_wrapperBoilerplates.clear(); 190d0825bca7fe65beaee391d30da42e937db621564Steve Block} 191d0825bca7fe65beaee391d30da42e937db621564Steve Block 192d0825bca7fe65beaee391d30da42e937db621564Steve Blockvoid V8DOMWindowShell::destroyGlobal() 193d0825bca7fe65beaee391d30da42e937db621564Steve Block{ 194d0825bca7fe65beaee391d30da42e937db621564Steve Block if (!m_global.IsEmpty()) { 195d0825bca7fe65beaee391d30da42e937db621564Steve Block#ifndef NDEBUG 196d0825bca7fe65beaee391d30da42e937db621564Steve Block V8GCController::unregisterGlobalHandle(this, m_global); 197d0825bca7fe65beaee391d30da42e937db621564Steve Block#endif 198d0825bca7fe65beaee391d30da42e937db621564Steve Block m_global.Dispose(); 199d0825bca7fe65beaee391d30da42e937db621564Steve Block m_global.Clear(); 200d0825bca7fe65beaee391d30da42e937db621564Steve Block } 201d0825bca7fe65beaee391d30da42e937db621564Steve Block} 202d0825bca7fe65beaee391d30da42e937db621564Steve Block 203d0825bca7fe65beaee391d30da42e937db621564Steve Blockvoid V8DOMWindowShell::clearForClose() 204d0825bca7fe65beaee391d30da42e937db621564Steve Block{ 205d0825bca7fe65beaee391d30da42e937db621564Steve Block if (!m_context.IsEmpty()) { 206d0825bca7fe65beaee391d30da42e937db621564Steve Block v8::HandleScope handleScope; 207d0825bca7fe65beaee391d30da42e937db621564Steve Block 208d0825bca7fe65beaee391d30da42e937db621564Steve Block clearDocumentWrapper(); 209d0825bca7fe65beaee391d30da42e937db621564Steve Block disposeContextHandles(); 210d0825bca7fe65beaee391d30da42e937db621564Steve Block } 211d0825bca7fe65beaee391d30da42e937db621564Steve Block} 212d0825bca7fe65beaee391d30da42e937db621564Steve Block 213d0825bca7fe65beaee391d30da42e937db621564Steve Blockvoid V8DOMWindowShell::clearForNavigation() 214d0825bca7fe65beaee391d30da42e937db621564Steve Block{ 215d0825bca7fe65beaee391d30da42e937db621564Steve Block if (!m_context.IsEmpty()) { 216d0825bca7fe65beaee391d30da42e937db621564Steve Block v8::HandleScope handle; 217d0825bca7fe65beaee391d30da42e937db621564Steve Block clearDocumentWrapper(); 218d0825bca7fe65beaee391d30da42e937db621564Steve Block 219d0825bca7fe65beaee391d30da42e937db621564Steve Block v8::Context::Scope contextScope(m_context); 220d0825bca7fe65beaee391d30da42e937db621564Steve Block 221d0825bca7fe65beaee391d30da42e937db621564Steve Block // Clear the document wrapper cache before turning on access checks on 222d0825bca7fe65beaee391d30da42e937db621564Steve Block // the old DOMWindow wrapper. This way, access to the document wrapper 223d0825bca7fe65beaee391d30da42e937db621564Steve Block // will be protected by the security checks on the DOMWindow wrapper. 224d0825bca7fe65beaee391d30da42e937db621564Steve Block clearDocumentWrapperCache(); 225d0825bca7fe65beaee391d30da42e937db621564Steve Block 226d0825bca7fe65beaee391d30da42e937db621564Steve Block // Turn on access check on the old DOMWindow wrapper. 2278a0914b749bbe7da7768e07a7db5c6d4bb09472bSteve Block v8::Handle<v8::Object> wrapper = V8DOMWrapper::lookupDOMWrapper(V8DOMWindow::GetTemplate(), m_global); 228d0825bca7fe65beaee391d30da42e937db621564Steve Block ASSERT(!wrapper.IsEmpty()); 229d0825bca7fe65beaee391d30da42e937db621564Steve Block wrapper->TurnOnAccessCheck(); 230d0825bca7fe65beaee391d30da42e937db621564Steve Block 231d0825bca7fe65beaee391d30da42e937db621564Steve Block // Separate the context from its global object. 232d0825bca7fe65beaee391d30da42e937db621564Steve Block m_context->DetachGlobal(); 233d0825bca7fe65beaee391d30da42e937db621564Steve Block 234d0825bca7fe65beaee391d30da42e937db621564Steve Block disposeContextHandles(); 235d0825bca7fe65beaee391d30da42e937db621564Steve Block } 236d0825bca7fe65beaee391d30da42e937db621564Steve Block} 237d0825bca7fe65beaee391d30da42e937db621564Steve Block 238d0825bca7fe65beaee391d30da42e937db621564Steve Block// Create a new environment and setup the global object. 239d0825bca7fe65beaee391d30da42e937db621564Steve Block// 240d0825bca7fe65beaee391d30da42e937db621564Steve Block// The global object corresponds to a DOMWindow instance. However, to 241d0825bca7fe65beaee391d30da42e937db621564Steve Block// allow properties of the JS DOMWindow instance to be shadowed, we 242d0825bca7fe65beaee391d30da42e937db621564Steve Block// use a shadow object as the global object and use the JS DOMWindow 243d0825bca7fe65beaee391d30da42e937db621564Steve Block// instance as the prototype for that shadow object. The JS DOMWindow 244d0825bca7fe65beaee391d30da42e937db621564Steve Block// instance is undetectable from javascript code because the __proto__ 245d0825bca7fe65beaee391d30da42e937db621564Steve Block// accessors skip that object. 246d0825bca7fe65beaee391d30da42e937db621564Steve Block// 247d0825bca7fe65beaee391d30da42e937db621564Steve Block// The shadow object and the DOMWindow instance are seen as one object 248d0825bca7fe65beaee391d30da42e937db621564Steve Block// from javascript. The javascript object that corresponds to a 249d0825bca7fe65beaee391d30da42e937db621564Steve Block// DOMWindow instance is the shadow object. When mapping a DOMWindow 250d0825bca7fe65beaee391d30da42e937db621564Steve Block// instance to a V8 object, we return the shadow object. 251d0825bca7fe65beaee391d30da42e937db621564Steve Block// 252d0825bca7fe65beaee391d30da42e937db621564Steve Block// To implement split-window, see 253d0825bca7fe65beaee391d30da42e937db621564Steve Block// 1) https://bugs.webkit.org/show_bug.cgi?id=17249 254d0825bca7fe65beaee391d30da42e937db621564Steve Block// 2) https://wiki.mozilla.org/Gecko:SplitWindow 255d0825bca7fe65beaee391d30da42e937db621564Steve Block// 3) https://bugzilla.mozilla.org/show_bug.cgi?id=296639 256d0825bca7fe65beaee391d30da42e937db621564Steve Block// we need to split the shadow object further into two objects: 257d0825bca7fe65beaee391d30da42e937db621564Steve Block// an outer window and an inner window. The inner window is the hidden 258d0825bca7fe65beaee391d30da42e937db621564Steve Block// prototype of the outer window. The inner window is the default 259d0825bca7fe65beaee391d30da42e937db621564Steve Block// global object of the context. A variable declared in the global 260d0825bca7fe65beaee391d30da42e937db621564Steve Block// scope is a property of the inner window. 261d0825bca7fe65beaee391d30da42e937db621564Steve Block// 262d0825bca7fe65beaee391d30da42e937db621564Steve Block// The outer window sticks to a Frame, it is exposed to JavaScript 263d0825bca7fe65beaee391d30da42e937db621564Steve Block// via window.window, window.self, window.parent, etc. The outer window 264d0825bca7fe65beaee391d30da42e937db621564Steve Block// has a security token which is the domain. The outer window cannot 265d0825bca7fe65beaee391d30da42e937db621564Steve Block// have its own properties. window.foo = 'x' is delegated to the 266d0825bca7fe65beaee391d30da42e937db621564Steve Block// inner window. 267d0825bca7fe65beaee391d30da42e937db621564Steve Block// 268d0825bca7fe65beaee391d30da42e937db621564Steve Block// When a frame navigates to a new page, the inner window is cut off 269d0825bca7fe65beaee391d30da42e937db621564Steve Block// the outer window, and the outer window identify is preserved for 270d0825bca7fe65beaee391d30da42e937db621564Steve Block// the frame. However, a new inner window is created for the new page. 271d0825bca7fe65beaee391d30da42e937db621564Steve Block// If there are JS code holds a closure to the old inner window, 272d0825bca7fe65beaee391d30da42e937db621564Steve Block// it won't be able to reach the outer window via its global object. 2735abb8606fa57c3ebfc8b3c3dbc3fa4a25d2ae306Iain Merrickbool V8DOMWindowShell::initContextIfNeeded() 274d0825bca7fe65beaee391d30da42e937db621564Steve Block{ 275d0825bca7fe65beaee391d30da42e937db621564Steve Block // Bail out if the context has already been initialized. 276d0825bca7fe65beaee391d30da42e937db621564Steve Block if (!m_context.IsEmpty()) 2775abb8606fa57c3ebfc8b3c3dbc3fa4a25d2ae306Iain Merrick return false; 278d0825bca7fe65beaee391d30da42e937db621564Steve Block 27991f28d81678b7c10358c9352239d6fb5cffb9550Steve Block#ifdef ANDROID_INSTRUMENT 28091f28d81678b7c10358c9352239d6fb5cffb9550Steve Block android::TimeCounter::start(android::TimeCounter::JavaScriptInitTimeCounter); 28191f28d81678b7c10358c9352239d6fb5cffb9550Steve Block#endif 28291f28d81678b7c10358c9352239d6fb5cffb9550Steve Block 283d0825bca7fe65beaee391d30da42e937db621564Steve Block // Create a handle scope for all local handles. 284d0825bca7fe65beaee391d30da42e937db621564Steve Block v8::HandleScope handleScope; 285d0825bca7fe65beaee391d30da42e937db621564Steve Block 286d0825bca7fe65beaee391d30da42e937db621564Steve Block // Setup the security handlers and message listener. This only has 287d0825bca7fe65beaee391d30da42e937db621564Steve Block // to be done once. 288d0825bca7fe65beaee391d30da42e937db621564Steve Block static bool isV8Initialized = false; 289d0825bca7fe65beaee391d30da42e937db621564Steve Block if (!isV8Initialized) { 290d0825bca7fe65beaee391d30da42e937db621564Steve Block // Tells V8 not to call the default OOM handler, binding code 291d0825bca7fe65beaee391d30da42e937db621564Steve Block // will handle it. 292d0825bca7fe65beaee391d30da42e937db621564Steve Block v8::V8::IgnoreOutOfMemoryException(); 293d0825bca7fe65beaee391d30da42e937db621564Steve Block v8::V8::SetFatalErrorHandler(reportFatalErrorInV8); 294d0825bca7fe65beaee391d30da42e937db621564Steve Block 295d0825bca7fe65beaee391d30da42e937db621564Steve Block v8::V8::SetGlobalGCPrologueCallback(&V8GCController::gcPrologue); 296d0825bca7fe65beaee391d30da42e937db621564Steve Block v8::V8::SetGlobalGCEpilogueCallback(&V8GCController::gcEpilogue); 297d0825bca7fe65beaee391d30da42e937db621564Steve Block 298ab9e7a118cf1ea2e3a93dce683b2ded3e7291ddbBen Murdoch v8::V8::AddMessageListener(&v8UncaughtExceptionHandler); 299d0825bca7fe65beaee391d30da42e937db621564Steve Block 300d0825bca7fe65beaee391d30da42e937db621564Steve Block v8::V8::SetFailedAccessCheckCallbackFunction(reportUnsafeJavaScriptAccess); 301d0825bca7fe65beaee391d30da42e937db621564Steve Block 302d0825bca7fe65beaee391d30da42e937db621564Steve Block isV8Initialized = true; 303d0825bca7fe65beaee391d30da42e937db621564Steve Block } 304d0825bca7fe65beaee391d30da42e937db621564Steve Block 305d0825bca7fe65beaee391d30da42e937db621564Steve Block 306d0825bca7fe65beaee391d30da42e937db621564Steve Block m_context = createNewContext(m_global, 0); 307d0825bca7fe65beaee391d30da42e937db621564Steve Block if (m_context.IsEmpty()) 3085abb8606fa57c3ebfc8b3c3dbc3fa4a25d2ae306Iain Merrick return false; 309d0825bca7fe65beaee391d30da42e937db621564Steve Block 310d0825bca7fe65beaee391d30da42e937db621564Steve Block v8::Local<v8::Context> v8Context = v8::Local<v8::Context>::New(m_context); 311d0825bca7fe65beaee391d30da42e937db621564Steve Block v8::Context::Scope contextScope(v8Context); 312d0825bca7fe65beaee391d30da42e937db621564Steve Block 313d0825bca7fe65beaee391d30da42e937db621564Steve Block // Store the first global object created so we can reuse it. 314d0825bca7fe65beaee391d30da42e937db621564Steve Block if (m_global.IsEmpty()) { 315d0825bca7fe65beaee391d30da42e937db621564Steve Block m_global = v8::Persistent<v8::Object>::New(v8Context->Global()); 316d0825bca7fe65beaee391d30da42e937db621564Steve Block // Bail out if allocation of the first global objects fails. 317d0825bca7fe65beaee391d30da42e937db621564Steve Block if (m_global.IsEmpty()) { 318d0825bca7fe65beaee391d30da42e937db621564Steve Block disposeContextHandles(); 3195abb8606fa57c3ebfc8b3c3dbc3fa4a25d2ae306Iain Merrick return false; 320d0825bca7fe65beaee391d30da42e937db621564Steve Block } 321d0825bca7fe65beaee391d30da42e937db621564Steve Block#ifndef NDEBUG 322d0825bca7fe65beaee391d30da42e937db621564Steve Block V8GCController::registerGlobalHandle(PROXY, this, m_global); 323d0825bca7fe65beaee391d30da42e937db621564Steve Block#endif 324d0825bca7fe65beaee391d30da42e937db621564Steve Block } 325d0825bca7fe65beaee391d30da42e937db621564Steve Block 326dcc8cf2e65d1aa555cce12431a16547e66b469eeSteve Block if (!installHiddenObjectPrototype(v8Context)) { 327d0825bca7fe65beaee391d30da42e937db621564Steve Block disposeContextHandles(); 3285abb8606fa57c3ebfc8b3c3dbc3fa4a25d2ae306Iain Merrick return false; 329d0825bca7fe65beaee391d30da42e937db621564Steve Block } 330d0825bca7fe65beaee391d30da42e937db621564Steve Block 331dcc8cf2e65d1aa555cce12431a16547e66b469eeSteve Block if (!installDOMWindow(v8Context, m_frame->domWindow())) { 332d0825bca7fe65beaee391d30da42e937db621564Steve Block disposeContextHandles(); 3335abb8606fa57c3ebfc8b3c3dbc3fa4a25d2ae306Iain Merrick return false; 334dcc8cf2e65d1aa555cce12431a16547e66b469eeSteve Block } 335d0825bca7fe65beaee391d30da42e937db621564Steve Block 336d0825bca7fe65beaee391d30da42e937db621564Steve Block updateDocument(); 337d0825bca7fe65beaee391d30da42e937db621564Steve Block 338d0825bca7fe65beaee391d30da42e937db621564Steve Block setSecurityToken(); 339d0825bca7fe65beaee391d30da42e937db621564Steve Block 340d0825bca7fe65beaee391d30da42e937db621564Steve Block m_frame->loader()->client()->didCreateScriptContextForFrame(); 341d0825bca7fe65beaee391d30da42e937db621564Steve Block 342d0825bca7fe65beaee391d30da42e937db621564Steve Block // FIXME: This is wrong. We should actually do this for the proper world once 343d0825bca7fe65beaee391d30da42e937db621564Steve Block // we do isolated worlds the WebCore way. 344d0825bca7fe65beaee391d30da42e937db621564Steve Block m_frame->loader()->dispatchDidClearWindowObjectInWorld(0); 34591f28d81678b7c10358c9352239d6fb5cffb9550Steve Block 34691f28d81678b7c10358c9352239d6fb5cffb9550Steve Block#ifdef ANDROID_INSTRUMENT 34791f28d81678b7c10358c9352239d6fb5cffb9550Steve Block android::TimeCounter::record(android::TimeCounter::JavaScriptInitTimeCounter, __FUNCTION__); 34891f28d81678b7c10358c9352239d6fb5cffb9550Steve Block#endif 34992451d3c3cebc17dfa2908de5836d2dae50d4a42Iain Merrick 3505abb8606fa57c3ebfc8b3c3dbc3fa4a25d2ae306Iain Merrick return true; 351d0825bca7fe65beaee391d30da42e937db621564Steve Block} 352d0825bca7fe65beaee391d30da42e937db621564Steve Block 353d0825bca7fe65beaee391d30da42e937db621564Steve Blockv8::Persistent<v8::Context> V8DOMWindowShell::createNewContext(v8::Handle<v8::Object> global, int extensionGroup) 354d0825bca7fe65beaee391d30da42e937db621564Steve Block{ 355d0825bca7fe65beaee391d30da42e937db621564Steve Block v8::Persistent<v8::Context> result; 356d0825bca7fe65beaee391d30da42e937db621564Steve Block 357d0825bca7fe65beaee391d30da42e937db621564Steve Block // The activeDocumentLoader pointer could be 0 during frame shutdown. 358d0825bca7fe65beaee391d30da42e937db621564Steve Block if (!m_frame->loader()->activeDocumentLoader()) 359d0825bca7fe65beaee391d30da42e937db621564Steve Block return result; 360d0825bca7fe65beaee391d30da42e937db621564Steve Block 361d0825bca7fe65beaee391d30da42e937db621564Steve Block // Create a new environment using an empty template for the shadow 362d0825bca7fe65beaee391d30da42e937db621564Steve Block // object. Reuse the global object if one has been created earlier. 363d0825bca7fe65beaee391d30da42e937db621564Steve Block v8::Persistent<v8::ObjectTemplate> globalTemplate = V8DOMWindow::GetShadowObjectTemplate(); 364d0825bca7fe65beaee391d30da42e937db621564Steve Block if (globalTemplate.IsEmpty()) 365d0825bca7fe65beaee391d30da42e937db621564Steve Block return result; 366d0825bca7fe65beaee391d30da42e937db621564Steve Block 367d0825bca7fe65beaee391d30da42e937db621564Steve Block // Used to avoid sleep calls in unload handlers. 368d0825bca7fe65beaee391d30da42e937db621564Steve Block if (!V8Proxy::registeredExtensionWithV8(DateExtension::get())) 369a94275402997c11dd2e778633dacf4b7e630a35dBen Murdoch V8Proxy::registerExtension(DateExtension::get()); 370d0825bca7fe65beaee391d30da42e937db621564Steve Block 371d0825bca7fe65beaee391d30da42e937db621564Steve Block // Dynamically tell v8 about our extensions now. 372d0825bca7fe65beaee391d30da42e937db621564Steve Block const V8Extensions& extensions = V8Proxy::extensions(); 373d0825bca7fe65beaee391d30da42e937db621564Steve Block OwnArrayPtr<const char*> extensionNames(new const char*[extensions.size()]); 374d0825bca7fe65beaee391d30da42e937db621564Steve Block int index = 0; 375d0825bca7fe65beaee391d30da42e937db621564Steve Block for (size_t i = 0; i < extensions.size(); ++i) { 376a94275402997c11dd2e778633dacf4b7e630a35dBen Murdoch // Ensure our date extension is always allowed. 377a94275402997c11dd2e778633dacf4b7e630a35dBen Murdoch if (extensions[i] != DateExtension::get() 378a94275402997c11dd2e778633dacf4b7e630a35dBen Murdoch && !m_frame->loader()->client()->allowScriptExtension(extensions[i]->name(), extensionGroup)) 379d0825bca7fe65beaee391d30da42e937db621564Steve Block continue; 380d0825bca7fe65beaee391d30da42e937db621564Steve Block 381a94275402997c11dd2e778633dacf4b7e630a35dBen Murdoch extensionNames[index++] = extensions[i]->name(); 382d0825bca7fe65beaee391d30da42e937db621564Steve Block } 383d0825bca7fe65beaee391d30da42e937db621564Steve Block v8::ExtensionConfiguration extensionConfiguration(index, extensionNames.get()); 384d0825bca7fe65beaee391d30da42e937db621564Steve Block result = v8::Context::New(&extensionConfiguration, globalTemplate, global); 385d0825bca7fe65beaee391d30da42e937db621564Steve Block 386d0825bca7fe65beaee391d30da42e937db621564Steve Block return result; 387d0825bca7fe65beaee391d30da42e937db621564Steve Block} 388d0825bca7fe65beaee391d30da42e937db621564Steve Block 3898fecd9c9a62aa89fb44ed3142ba583dc7b8cbe29Andrei Popescuvoid V8DOMWindowShell::setContext(v8::Handle<v8::Context> context) 390d0825bca7fe65beaee391d30da42e937db621564Steve Block{ 391dcc8cf2e65d1aa555cce12431a16547e66b469eeSteve Block // if we already have a context, clear it before setting the new one. 392dcc8cf2e65d1aa555cce12431a16547e66b469eeSteve Block if (!m_context.IsEmpty()) { 393dcc8cf2e65d1aa555cce12431a16547e66b469eeSteve Block m_context.Dispose(); 394dcc8cf2e65d1aa555cce12431a16547e66b469eeSteve Block m_context.Clear(); 395dcc8cf2e65d1aa555cce12431a16547e66b469eeSteve Block } 396dcc8cf2e65d1aa555cce12431a16547e66b469eeSteve Block m_context = v8::Persistent<v8::Context>::New(context); 397dcc8cf2e65d1aa555cce12431a16547e66b469eeSteve Block} 398d0825bca7fe65beaee391d30da42e937db621564Steve Block 399dcc8cf2e65d1aa555cce12431a16547e66b469eeSteve Blockbool V8DOMWindowShell::installDOMWindow(v8::Handle<v8::Context> context, DOMWindow* window) 400dcc8cf2e65d1aa555cce12431a16547e66b469eeSteve Block{ 401d0825bca7fe65beaee391d30da42e937db621564Steve Block // Create a new JS window object and use it as the prototype for the shadow global object. 402dcc8cf2e65d1aa555cce12431a16547e66b469eeSteve Block v8::Handle<v8::Function> windowConstructor = V8DOMWrapper::getConstructor(&V8DOMWindow::info, getHiddenObjectPrototype(context)); 403d0825bca7fe65beaee391d30da42e937db621564Steve Block v8::Local<v8::Object> jsWindow = SafeAllocation::newInstance(windowConstructor); 404d0825bca7fe65beaee391d30da42e937db621564Steve Block // Bail out if allocation failed. 405d0825bca7fe65beaee391d30da42e937db621564Steve Block if (jsWindow.IsEmpty()) 406d0825bca7fe65beaee391d30da42e937db621564Steve Block return false; 407d0825bca7fe65beaee391d30da42e937db621564Steve Block 408d0825bca7fe65beaee391d30da42e937db621564Steve Block // Wrap the window. 409dcc8cf2e65d1aa555cce12431a16547e66b469eeSteve Block V8DOMWrapper::setDOMWrapper(jsWindow, &V8DOMWindow::info, window); 410dcc8cf2e65d1aa555cce12431a16547e66b469eeSteve Block V8DOMWrapper::setDOMWrapper(v8::Handle<v8::Object>::Cast(jsWindow->GetPrototype()), &V8DOMWindow::info, window); 411d0825bca7fe65beaee391d30da42e937db621564Steve Block 412d0825bca7fe65beaee391d30da42e937db621564Steve Block window->ref(); 413d0825bca7fe65beaee391d30da42e937db621564Steve Block V8DOMWrapper::setJSWrapperForDOMObject(window, v8::Persistent<v8::Object>::New(jsWindow)); 414d0825bca7fe65beaee391d30da42e937db621564Steve Block 415d0825bca7fe65beaee391d30da42e937db621564Steve Block // Insert the window instance as the prototype of the shadow object. 416dcc8cf2e65d1aa555cce12431a16547e66b469eeSteve Block v8::Handle<v8::Object> v8RealGlobal = v8::Handle<v8::Object>::Cast(context->Global()->GetPrototype()); 417dcc8cf2e65d1aa555cce12431a16547e66b469eeSteve Block V8DOMWrapper::setDOMWrapper(v8RealGlobal, &V8DOMWindow::info, window); 418dcc8cf2e65d1aa555cce12431a16547e66b469eeSteve Block v8RealGlobal->SetPrototype(jsWindow); 419d0825bca7fe65beaee391d30da42e937db621564Steve Block return true; 420d0825bca7fe65beaee391d30da42e937db621564Steve Block} 421d0825bca7fe65beaee391d30da42e937db621564Steve Block 4228a0914b749bbe7da7768e07a7db5c6d4bb09472bSteve Blockvoid V8DOMWindowShell::updateDocumentWrapper(v8::Handle<v8::Object> wrapper) 423d0825bca7fe65beaee391d30da42e937db621564Steve Block{ 424d0825bca7fe65beaee391d30da42e937db621564Steve Block clearDocumentWrapper(); 425d0825bca7fe65beaee391d30da42e937db621564Steve Block 426d0825bca7fe65beaee391d30da42e937db621564Steve Block ASSERT(m_document.IsEmpty()); 4278a0914b749bbe7da7768e07a7db5c6d4bb09472bSteve Block m_document = v8::Persistent<v8::Object>::New(wrapper); 428d0825bca7fe65beaee391d30da42e937db621564Steve Block#ifndef NDEBUG 429d0825bca7fe65beaee391d30da42e937db621564Steve Block V8GCController::registerGlobalHandle(PROXY, this, m_document); 430d0825bca7fe65beaee391d30da42e937db621564Steve Block#endif 431d0825bca7fe65beaee391d30da42e937db621564Steve Block} 432d0825bca7fe65beaee391d30da42e937db621564Steve Block 433d0825bca7fe65beaee391d30da42e937db621564Steve Blockvoid V8DOMWindowShell::clearDocumentWrapper() 434d0825bca7fe65beaee391d30da42e937db621564Steve Block{ 435d0825bca7fe65beaee391d30da42e937db621564Steve Block if (!m_document.IsEmpty()) { 436d0825bca7fe65beaee391d30da42e937db621564Steve Block#ifndef NDEBUG 437d0825bca7fe65beaee391d30da42e937db621564Steve Block V8GCController::unregisterGlobalHandle(this, m_document); 438d0825bca7fe65beaee391d30da42e937db621564Steve Block#endif 439d0825bca7fe65beaee391d30da42e937db621564Steve Block m_document.Dispose(); 440d0825bca7fe65beaee391d30da42e937db621564Steve Block m_document.Clear(); 441d0825bca7fe65beaee391d30da42e937db621564Steve Block } 442d0825bca7fe65beaee391d30da42e937db621564Steve Block} 443d0825bca7fe65beaee391d30da42e937db621564Steve Block 444f486d19d62f1bc33246748b14b14a9dfa617b57fIain Merrickstatic void checkDocumentWrapper(v8::Handle<v8::Object> wrapper, Document* document) 445f486d19d62f1bc33246748b14b14a9dfa617b57fIain Merrick{ 446f486d19d62f1bc33246748b14b14a9dfa617b57fIain Merrick ASSERT(V8Document::toNative(wrapper) == document); 447f486d19d62f1bc33246748b14b14a9dfa617b57fIain Merrick ASSERT(!document->isHTMLDocument() || (V8Document::toNative(v8::Handle<v8::Object>::Cast(wrapper->GetPrototype())) == document)); 448f486d19d62f1bc33246748b14b14a9dfa617b57fIain Merrick} 449f486d19d62f1bc33246748b14b14a9dfa617b57fIain Merrick 450d0825bca7fe65beaee391d30da42e937db621564Steve Blockvoid V8DOMWindowShell::updateDocumentWrapperCache() 451d0825bca7fe65beaee391d30da42e937db621564Steve Block{ 452d0825bca7fe65beaee391d30da42e937db621564Steve Block v8::HandleScope handleScope; 453d0825bca7fe65beaee391d30da42e937db621564Steve Block v8::Context::Scope contextScope(m_context); 454d0825bca7fe65beaee391d30da42e937db621564Steve Block 455d0825bca7fe65beaee391d30da42e937db621564Steve Block // If the document has no frame, NodeToV8Object might get the 456d0825bca7fe65beaee391d30da42e937db621564Steve Block // document wrapper for a document that is about to be deleted. 457d0825bca7fe65beaee391d30da42e937db621564Steve Block // If the ForceSet below causes a garbage collection, the document 458d0825bca7fe65beaee391d30da42e937db621564Steve Block // might get deleted and the global handle for the document 459d0825bca7fe65beaee391d30da42e937db621564Steve Block // wrapper cleared. Using the cleared global handle will lead to 460d0825bca7fe65beaee391d30da42e937db621564Steve Block // crashes. In this case we clear the cache and let the DOMWindow 461d0825bca7fe65beaee391d30da42e937db621564Steve Block // accessor handle access to the document. 462d0825bca7fe65beaee391d30da42e937db621564Steve Block if (!m_frame->document()->frame()) { 463d0825bca7fe65beaee391d30da42e937db621564Steve Block clearDocumentWrapperCache(); 464d0825bca7fe65beaee391d30da42e937db621564Steve Block return; 465d0825bca7fe65beaee391d30da42e937db621564Steve Block } 466d0825bca7fe65beaee391d30da42e937db621564Steve Block 4675e2bc6953fe6923165b8a5d7679939693a1d58d6Steve Block v8::Handle<v8::Value> documentWrapper = toV8(m_frame->document()); 468f486d19d62f1bc33246748b14b14a9dfa617b57fIain Merrick ASSERT(documentWrapper == m_document || m_document.IsEmpty()); 469f486d19d62f1bc33246748b14b14a9dfa617b57fIain Merrick if (m_document.IsEmpty()) 470f486d19d62f1bc33246748b14b14a9dfa617b57fIain Merrick updateDocumentWrapper(v8::Handle<v8::Object>::Cast(documentWrapper)); 471f486d19d62f1bc33246748b14b14a9dfa617b57fIain Merrick checkDocumentWrapper(m_document, m_frame->document()); 472d0825bca7fe65beaee391d30da42e937db621564Steve Block 473d0825bca7fe65beaee391d30da42e937db621564Steve Block // If instantiation of the document wrapper fails, clear the cache 474d0825bca7fe65beaee391d30da42e937db621564Steve Block // and let the DOMWindow accessor handle access to the document. 475d0825bca7fe65beaee391d30da42e937db621564Steve Block if (documentWrapper.IsEmpty()) { 476d0825bca7fe65beaee391d30da42e937db621564Steve Block clearDocumentWrapperCache(); 477d0825bca7fe65beaee391d30da42e937db621564Steve Block return; 478d0825bca7fe65beaee391d30da42e937db621564Steve Block } 4798a0914b749bbe7da7768e07a7db5c6d4bb09472bSteve Block ASSERT(documentWrapper->IsObject()); 480d0825bca7fe65beaee391d30da42e937db621564Steve Block m_context->Global()->ForceSet(v8::String::New("document"), documentWrapper, static_cast<v8::PropertyAttribute>(v8::ReadOnly | v8::DontDelete)); 481d0825bca7fe65beaee391d30da42e937db621564Steve Block} 482d0825bca7fe65beaee391d30da42e937db621564Steve Block 483d0825bca7fe65beaee391d30da42e937db621564Steve Blockvoid V8DOMWindowShell::clearDocumentWrapperCache() 484d0825bca7fe65beaee391d30da42e937db621564Steve Block{ 485d0825bca7fe65beaee391d30da42e937db621564Steve Block ASSERT(!m_context.IsEmpty()); 486d0825bca7fe65beaee391d30da42e937db621564Steve Block m_context->Global()->ForceDelete(v8::String::New("document")); 487d0825bca7fe65beaee391d30da42e937db621564Steve Block} 488d0825bca7fe65beaee391d30da42e937db621564Steve Block 489d0825bca7fe65beaee391d30da42e937db621564Steve Blockvoid V8DOMWindowShell::setSecurityToken() 490d0825bca7fe65beaee391d30da42e937db621564Steve Block{ 491d0825bca7fe65beaee391d30da42e937db621564Steve Block Document* document = m_frame->document(); 492d0825bca7fe65beaee391d30da42e937db621564Steve Block // Setup security origin and security token. 493d0825bca7fe65beaee391d30da42e937db621564Steve Block if (!document) { 494d0825bca7fe65beaee391d30da42e937db621564Steve Block m_context->UseDefaultSecurityToken(); 495d0825bca7fe65beaee391d30da42e937db621564Steve Block return; 496d0825bca7fe65beaee391d30da42e937db621564Steve Block } 497d0825bca7fe65beaee391d30da42e937db621564Steve Block 498d0825bca7fe65beaee391d30da42e937db621564Steve Block // Ask the document's SecurityOrigin to generate a security token. 499d0825bca7fe65beaee391d30da42e937db621564Steve Block // If two tokens are equal, then the SecurityOrigins canAccess each other. 500d0825bca7fe65beaee391d30da42e937db621564Steve Block // If two tokens are not equal, then we have to call canAccess. 501d0825bca7fe65beaee391d30da42e937db621564Steve Block // Note: we can't use the HTTPOrigin if it was set from the DOM. 502d0825bca7fe65beaee391d30da42e937db621564Steve Block SecurityOrigin* origin = document->securityOrigin(); 503d0825bca7fe65beaee391d30da42e937db621564Steve Block String token; 504d0825bca7fe65beaee391d30da42e937db621564Steve Block if (!origin->domainWasSetInDOM()) 505d0825bca7fe65beaee391d30da42e937db621564Steve Block token = document->securityOrigin()->toString(); 506d0825bca7fe65beaee391d30da42e937db621564Steve Block 507d0825bca7fe65beaee391d30da42e937db621564Steve Block // An empty or "null" token means we always have to call 508d0825bca7fe65beaee391d30da42e937db621564Steve Block // canAccess. The toString method on securityOrigins returns the 509d0825bca7fe65beaee391d30da42e937db621564Steve Block // string "null" for empty security origins and for security 510d0825bca7fe65beaee391d30da42e937db621564Steve Block // origins that should only allow access to themselves. In this 511d0825bca7fe65beaee391d30da42e937db621564Steve Block // case, we use the global object as the security token to avoid 512d0825bca7fe65beaee391d30da42e937db621564Steve Block // calling canAccess when a script accesses its own objects. 513d0825bca7fe65beaee391d30da42e937db621564Steve Block if (token.isEmpty() || token == "null") { 514d0825bca7fe65beaee391d30da42e937db621564Steve Block m_context->UseDefaultSecurityToken(); 515d0825bca7fe65beaee391d30da42e937db621564Steve Block return; 516d0825bca7fe65beaee391d30da42e937db621564Steve Block } 517d0825bca7fe65beaee391d30da42e937db621564Steve Block 518d0825bca7fe65beaee391d30da42e937db621564Steve Block CString utf8Token = token.utf8(); 519d0825bca7fe65beaee391d30da42e937db621564Steve Block // NOTE: V8 does identity comparison in fast path, must use a symbol 520d0825bca7fe65beaee391d30da42e937db621564Steve Block // as the security token. 521d0825bca7fe65beaee391d30da42e937db621564Steve Block m_context->SetSecurityToken(v8::String::NewSymbol(utf8Token.data(), utf8Token.length())); 522d0825bca7fe65beaee391d30da42e937db621564Steve Block} 523d0825bca7fe65beaee391d30da42e937db621564Steve Block 524d0825bca7fe65beaee391d30da42e937db621564Steve Blockvoid V8DOMWindowShell::updateDocument() 525d0825bca7fe65beaee391d30da42e937db621564Steve Block{ 526d0825bca7fe65beaee391d30da42e937db621564Steve Block if (!m_frame->document()) 527d0825bca7fe65beaee391d30da42e937db621564Steve Block return; 528d0825bca7fe65beaee391d30da42e937db621564Steve Block 529d0825bca7fe65beaee391d30da42e937db621564Steve Block if (m_global.IsEmpty()) 530d0825bca7fe65beaee391d30da42e937db621564Steve Block return; 531d0825bca7fe65beaee391d30da42e937db621564Steve Block 532d0825bca7fe65beaee391d30da42e937db621564Steve Block // There is an existing JavaScript wrapper for the global object 533d0825bca7fe65beaee391d30da42e937db621564Steve Block // of this frame. JavaScript code in other frames might hold a 534d0825bca7fe65beaee391d30da42e937db621564Steve Block // reference to this wrapper. We eagerly initialize the JavaScript 535d0825bca7fe65beaee391d30da42e937db621564Steve Block // context for the new document to make property access on the 536d0825bca7fe65beaee391d30da42e937db621564Steve Block // global object wrapper succeed. 537d0825bca7fe65beaee391d30da42e937db621564Steve Block initContextIfNeeded(); 538d0825bca7fe65beaee391d30da42e937db621564Steve Block 539d0825bca7fe65beaee391d30da42e937db621564Steve Block // Bail out if context initialization failed. 540d0825bca7fe65beaee391d30da42e937db621564Steve Block if (m_context.IsEmpty()) 541d0825bca7fe65beaee391d30da42e937db621564Steve Block return; 542d0825bca7fe65beaee391d30da42e937db621564Steve Block 543d0825bca7fe65beaee391d30da42e937db621564Steve Block // We have a new document and we need to update the cache. 544d0825bca7fe65beaee391d30da42e937db621564Steve Block updateDocumentWrapperCache(); 545d0825bca7fe65beaee391d30da42e937db621564Steve Block 546d0825bca7fe65beaee391d30da42e937db621564Steve Block updateSecurityOrigin(); 547d0825bca7fe65beaee391d30da42e937db621564Steve Block} 548d0825bca7fe65beaee391d30da42e937db621564Steve Block 549f486d19d62f1bc33246748b14b14a9dfa617b57fIain Merrickv8::Handle<v8::Value> getter(v8::Local<v8::String> property, const v8::AccessorInfo& info) 550f486d19d62f1bc33246748b14b14a9dfa617b57fIain Merrick{ 551f486d19d62f1bc33246748b14b14a9dfa617b57fIain Merrick // FIXME(antonm): consider passing AtomicStringImpl directly. 552f486d19d62f1bc33246748b14b14a9dfa617b57fIain Merrick AtomicString name = v8StringToAtomicWebCoreString(property); 553f486d19d62f1bc33246748b14b14a9dfa617b57fIain Merrick HTMLDocument* htmlDocument = V8HTMLDocument::toNative(info.Holder()); 554f486d19d62f1bc33246748b14b14a9dfa617b57fIain Merrick ASSERT(htmlDocument); 555f486d19d62f1bc33246748b14b14a9dfa617b57fIain Merrick v8::Handle<v8::Value> result = V8HTMLDocument::GetNamedProperty(htmlDocument, name); 556f486d19d62f1bc33246748b14b14a9dfa617b57fIain Merrick if (!result.IsEmpty()) 557f486d19d62f1bc33246748b14b14a9dfa617b57fIain Merrick return result; 558f486d19d62f1bc33246748b14b14a9dfa617b57fIain Merrick v8::Handle<v8::Value> prototype = info.Holder()->GetPrototype(); 559f486d19d62f1bc33246748b14b14a9dfa617b57fIain Merrick if (prototype->IsObject()) 560f486d19d62f1bc33246748b14b14a9dfa617b57fIain Merrick return prototype.As<v8::Object>()->Get(property); 561f486d19d62f1bc33246748b14b14a9dfa617b57fIain Merrick return v8::Undefined(); 562f486d19d62f1bc33246748b14b14a9dfa617b57fIain Merrick} 563f486d19d62f1bc33246748b14b14a9dfa617b57fIain Merrick 564f486d19d62f1bc33246748b14b14a9dfa617b57fIain Merrickvoid V8DOMWindowShell::namedItemAdded(HTMLDocument* doc, const AtomicString& name) 565f486d19d62f1bc33246748b14b14a9dfa617b57fIain Merrick{ 566f486d19d62f1bc33246748b14b14a9dfa617b57fIain Merrick initContextIfNeeded(); 567f486d19d62f1bc33246748b14b14a9dfa617b57fIain Merrick 568f486d19d62f1bc33246748b14b14a9dfa617b57fIain Merrick v8::HandleScope handleScope; 569f486d19d62f1bc33246748b14b14a9dfa617b57fIain Merrick v8::Context::Scope contextScope(m_context); 570f486d19d62f1bc33246748b14b14a9dfa617b57fIain Merrick 571f486d19d62f1bc33246748b14b14a9dfa617b57fIain Merrick ASSERT(!m_document.IsEmpty()); 572f486d19d62f1bc33246748b14b14a9dfa617b57fIain Merrick checkDocumentWrapper(m_document, doc); 573f486d19d62f1bc33246748b14b14a9dfa617b57fIain Merrick m_document->SetAccessor(v8String(name), getter); 574f486d19d62f1bc33246748b14b14a9dfa617b57fIain Merrick} 575f486d19d62f1bc33246748b14b14a9dfa617b57fIain Merrick 576f486d19d62f1bc33246748b14b14a9dfa617b57fIain Merrickvoid V8DOMWindowShell::namedItemRemoved(HTMLDocument* doc, const AtomicString& name) 577f486d19d62f1bc33246748b14b14a9dfa617b57fIain Merrick{ 578f486d19d62f1bc33246748b14b14a9dfa617b57fIain Merrick} 579f486d19d62f1bc33246748b14b14a9dfa617b57fIain Merrick 580d0825bca7fe65beaee391d30da42e937db621564Steve Blockvoid V8DOMWindowShell::updateSecurityOrigin() 581d0825bca7fe65beaee391d30da42e937db621564Steve Block{ 582d0825bca7fe65beaee391d30da42e937db621564Steve Block v8::HandleScope scope; 583d0825bca7fe65beaee391d30da42e937db621564Steve Block setSecurityToken(); 584d0825bca7fe65beaee391d30da42e937db621564Steve Block} 585d0825bca7fe65beaee391d30da42e937db621564Steve Block 586d0825bca7fe65beaee391d30da42e937db621564Steve Blockv8::Handle<v8::Value> V8DOMWindowShell::getHiddenObjectPrototype(v8::Handle<v8::Context> context) 587d0825bca7fe65beaee391d30da42e937db621564Steve Block{ 588d0825bca7fe65beaee391d30da42e937db621564Steve Block return context->Global()->GetHiddenValue(V8HiddenPropertyName::objectPrototype()); 589d0825bca7fe65beaee391d30da42e937db621564Steve Block} 590d0825bca7fe65beaee391d30da42e937db621564Steve Block 591dcc8cf2e65d1aa555cce12431a16547e66b469eeSteve Blockbool V8DOMWindowShell::installHiddenObjectPrototype(v8::Handle<v8::Context> context) 592d0825bca7fe65beaee391d30da42e937db621564Steve Block{ 593d0825bca7fe65beaee391d30da42e937db621564Steve Block v8::Handle<v8::String> objectString = v8::String::New("Object"); 594d0825bca7fe65beaee391d30da42e937db621564Steve Block v8::Handle<v8::String> prototypeString = v8::String::New("prototype"); 595d0825bca7fe65beaee391d30da42e937db621564Steve Block v8::Handle<v8::String> hiddenObjectPrototypeString = V8HiddenPropertyName::objectPrototype(); 596d0825bca7fe65beaee391d30da42e937db621564Steve Block // Bail out if allocation failed. 597d0825bca7fe65beaee391d30da42e937db621564Steve Block if (objectString.IsEmpty() || prototypeString.IsEmpty() || hiddenObjectPrototypeString.IsEmpty()) 598dcc8cf2e65d1aa555cce12431a16547e66b469eeSteve Block return false; 599d0825bca7fe65beaee391d30da42e937db621564Steve Block 600d0825bca7fe65beaee391d30da42e937db621564Steve Block v8::Handle<v8::Object> object = v8::Handle<v8::Object>::Cast(context->Global()->Get(objectString)); 601dcc8cf2e65d1aa555cce12431a16547e66b469eeSteve Block // Bail out if fetching failed. 602dcc8cf2e65d1aa555cce12431a16547e66b469eeSteve Block if (object.IsEmpty()) 603dcc8cf2e65d1aa555cce12431a16547e66b469eeSteve Block return false; 604d0825bca7fe65beaee391d30da42e937db621564Steve Block v8::Handle<v8::Value> objectPrototype = object->Get(prototypeString); 605dcc8cf2e65d1aa555cce12431a16547e66b469eeSteve Block // Bail out if fetching failed. 606dcc8cf2e65d1aa555cce12431a16547e66b469eeSteve Block if (objectPrototype.IsEmpty()) 607dcc8cf2e65d1aa555cce12431a16547e66b469eeSteve Block return false; 608d0825bca7fe65beaee391d30da42e937db621564Steve Block 609d0825bca7fe65beaee391d30da42e937db621564Steve Block context->Global()->SetHiddenValue(hiddenObjectPrototypeString, objectPrototype); 610dcc8cf2e65d1aa555cce12431a16547e66b469eeSteve Block 611dcc8cf2e65d1aa555cce12431a16547e66b469eeSteve Block return true; 612d0825bca7fe65beaee391d30da42e937db621564Steve Block} 613d0825bca7fe65beaee391d30da42e937db621564Steve Block 614dcc8cf2e65d1aa555cce12431a16547e66b469eeSteve Blockv8::Local<v8::Object> V8DOMWindowShell::createWrapperFromCacheSlowCase(WrapperTypeInfo* type) 615d0825bca7fe65beaee391d30da42e937db621564Steve Block{ 616d0825bca7fe65beaee391d30da42e937db621564Steve Block // Not in cache. 617d0825bca7fe65beaee391d30da42e937db621564Steve Block initContextIfNeeded(); 618d0825bca7fe65beaee391d30da42e937db621564Steve Block v8::Context::Scope scope(m_context); 619d0825bca7fe65beaee391d30da42e937db621564Steve Block v8::Local<v8::Function> function = V8DOMWrapper::getConstructor(type, getHiddenObjectPrototype(m_context)); 620d0825bca7fe65beaee391d30da42e937db621564Steve Block v8::Local<v8::Object> instance = SafeAllocation::newInstance(function); 621d0825bca7fe65beaee391d30da42e937db621564Steve Block if (!instance.IsEmpty()) { 622dcc8cf2e65d1aa555cce12431a16547e66b469eeSteve Block m_wrapperBoilerplates.set(type, v8::Persistent<v8::Object>::New(instance)); 623d0825bca7fe65beaee391d30da42e937db621564Steve Block return instance->Clone(); 624d0825bca7fe65beaee391d30da42e937db621564Steve Block } 625d0825bca7fe65beaee391d30da42e937db621564Steve Block return notHandledByInterceptor(); 626d0825bca7fe65beaee391d30da42e937db621564Steve Block} 627d0825bca7fe65beaee391d30da42e937db621564Steve Block 628cad810f21b803229eb11403f9209855525a25d57Steve Blockvoid V8DOMWindowShell::setLocation(DOMWindow* window, const String& locationString) 629d0825bca7fe65beaee391d30da42e937db621564Steve Block{ 630cad810f21b803229eb11403f9209855525a25d57Steve Block State<V8Binding>* state = V8BindingState::Only(); 631cad810f21b803229eb11403f9209855525a25d57Steve Block window->setLocation(locationString, state->activeWindow(), state->firstWindow()); 632d0825bca7fe65beaee391d30da42e937db621564Steve Block} 633d0825bca7fe65beaee391d30da42e937db621564Steve Block 634d0825bca7fe65beaee391d30da42e937db621564Steve Block} // WebCore 635