V8DOMWindowShell.cpp revision ab9e7a118cf1ea2e3a93dce683b2ded3e7291ddb
1d0825bca7fe65beaee391d30da42e937db621564Steve Block/*
2d0825bca7fe65beaee391d30da42e937db621564Steve Block * Copyright (C) 2008, 2009 Google Inc. All rights reserved.
3d0825bca7fe65beaee391d30da42e937db621564Steve Block *
4d0825bca7fe65beaee391d30da42e937db621564Steve Block * Redistribution and use in source and binary forms, with or without
5d0825bca7fe65beaee391d30da42e937db621564Steve Block * modification, are permitted provided that the following conditions are
6d0825bca7fe65beaee391d30da42e937db621564Steve Block * met:
7d0825bca7fe65beaee391d30da42e937db621564Steve Block *
8d0825bca7fe65beaee391d30da42e937db621564Steve Block *     * Redistributions of source code must retain the above copyright
9d0825bca7fe65beaee391d30da42e937db621564Steve Block * notice, this list of conditions and the following disclaimer.
10d0825bca7fe65beaee391d30da42e937db621564Steve Block *     * Redistributions in binary form must reproduce the above
11d0825bca7fe65beaee391d30da42e937db621564Steve Block * copyright notice, this list of conditions and the following disclaimer
12d0825bca7fe65beaee391d30da42e937db621564Steve Block * in the documentation and/or other materials provided with the
13d0825bca7fe65beaee391d30da42e937db621564Steve Block * distribution.
14d0825bca7fe65beaee391d30da42e937db621564Steve Block *     * Neither the name of Google Inc. nor the names of its
15d0825bca7fe65beaee391d30da42e937db621564Steve Block * contributors may be used to endorse or promote products derived from
16d0825bca7fe65beaee391d30da42e937db621564Steve Block * this software without specific prior written permission.
17d0825bca7fe65beaee391d30da42e937db621564Steve Block *
18d0825bca7fe65beaee391d30da42e937db621564Steve Block * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
19d0825bca7fe65beaee391d30da42e937db621564Steve Block * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
20d0825bca7fe65beaee391d30da42e937db621564Steve Block * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
21d0825bca7fe65beaee391d30da42e937db621564Steve Block * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
22d0825bca7fe65beaee391d30da42e937db621564Steve Block * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
23d0825bca7fe65beaee391d30da42e937db621564Steve Block * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
24d0825bca7fe65beaee391d30da42e937db621564Steve Block * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
25d0825bca7fe65beaee391d30da42e937db621564Steve Block * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
26d0825bca7fe65beaee391d30da42e937db621564Steve Block * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
27d0825bca7fe65beaee391d30da42e937db621564Steve Block * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
28d0825bca7fe65beaee391d30da42e937db621564Steve Block * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
29d0825bca7fe65beaee391d30da42e937db621564Steve Block */
30d0825bca7fe65beaee391d30da42e937db621564Steve Block
31d0825bca7fe65beaee391d30da42e937db621564Steve Block#include "config.h"
32d0825bca7fe65beaee391d30da42e937db621564Steve Block#include "V8DOMWindowShell.h"
33d0825bca7fe65beaee391d30da42e937db621564Steve Block
34d0825bca7fe65beaee391d30da42e937db621564Steve Block#include "PlatformBridge.h"
35d0825bca7fe65beaee391d30da42e937db621564Steve Block#include "CSSMutableStyleDeclaration.h"
36d0825bca7fe65beaee391d30da42e937db621564Steve Block#include "DateExtension.h"
37d0825bca7fe65beaee391d30da42e937db621564Steve Block#include "DocumentLoader.h"
38d0825bca7fe65beaee391d30da42e937db621564Steve Block#include "Frame.h"
39d0825bca7fe65beaee391d30da42e937db621564Steve Block#include "FrameLoaderClient.h"
40d0825bca7fe65beaee391d30da42e937db621564Steve Block#include "Page.h"
41d0825bca7fe65beaee391d30da42e937db621564Steve Block#include "PageGroup.h"
42ab9e7a118cf1ea2e3a93dce683b2ded3e7291ddbBen Murdoch#include "ScriptCallStack.h"
43ab9e7a118cf1ea2e3a93dce683b2ded3e7291ddbBen Murdoch#include "ScriptCallStackFactory.h"
44d0825bca7fe65beaee391d30da42e937db621564Steve Block#include "ScriptController.h"
45d0825bca7fe65beaee391d30da42e937db621564Steve Block#include "StorageNamespace.h"
46d0825bca7fe65beaee391d30da42e937db621564Steve Block#include "V8Binding.h"
47d0825bca7fe65beaee391d30da42e937db621564Steve Block#include "V8BindingState.h"
48d0825bca7fe65beaee391d30da42e937db621564Steve Block#include "V8Collection.h"
49d0825bca7fe65beaee391d30da42e937db621564Steve Block#include "V8DOMMap.h"
50d0825bca7fe65beaee391d30da42e937db621564Steve Block#include "V8DOMWindow.h"
515e2bc6953fe6923165b8a5d7679939693a1d58d6Steve Block#include "V8Document.h"
52dcc8cf2e65d1aa555cce12431a16547e66b469eeSteve Block#include "V8GCForContextDispose.h"
53f486d19d62f1bc33246748b14b14a9dfa617b57fIain Merrick#include "V8HTMLDocument.h"
54d0825bca7fe65beaee391d30da42e937db621564Steve Block#include "V8HiddenPropertyName.h"
55d0825bca7fe65beaee391d30da42e937db621564Steve Block#include "V8History.h"
56d0825bca7fe65beaee391d30da42e937db621564Steve Block#include "V8Location.h"
57d0825bca7fe65beaee391d30da42e937db621564Steve Block#include "V8Proxy.h"
58d0825bca7fe65beaee391d30da42e937db621564Steve Block#include "WorkerContextExecutionProxy.h"
59d0825bca7fe65beaee391d30da42e937db621564Steve Block
60d0825bca7fe65beaee391d30da42e937db621564Steve Block#include <algorithm>
61d0825bca7fe65beaee391d30da42e937db621564Steve Block#include <stdio.h>
62d0825bca7fe65beaee391d30da42e937db621564Steve Block#include <utility>
63d0825bca7fe65beaee391d30da42e937db621564Steve Block#include <v8-debug.h>
64d0825bca7fe65beaee391d30da42e937db621564Steve Block#include <v8.h>
65d0825bca7fe65beaee391d30da42e937db621564Steve Block#include <wtf/Assertions.h>
66d0825bca7fe65beaee391d30da42e937db621564Steve Block#include <wtf/OwnArrayPtr.h>
67d0825bca7fe65beaee391d30da42e937db621564Steve Block#include <wtf/StdLibExtras.h>
68d0825bca7fe65beaee391d30da42e937db621564Steve Block#include <wtf/StringExtras.h>
69d0825bca7fe65beaee391d30da42e937db621564Steve Block#include <wtf/UnusedParam.h>
70dcc8cf2e65d1aa555cce12431a16547e66b469eeSteve Block#include <wtf/text/CString.h>
71d0825bca7fe65beaee391d30da42e937db621564Steve Block
724526b6115fa4e132102aec80e9da22c0f85288f6Andrei Popescu#ifdef ANDROID_INSTRUMENT
734bbbef2a208187104163ecdbe4278d709dede038Andrei Popescu#include "TimeCounter.h"
744bbbef2a208187104163ecdbe4278d709dede038Andrei Popescu#endif
754bbbef2a208187104163ecdbe4278d709dede038Andrei Popescu
76d0825bca7fe65beaee391d30da42e937db621564Steve Blocknamespace WebCore {
77d0825bca7fe65beaee391d30da42e937db621564Steve Block
78d0825bca7fe65beaee391d30da42e937db621564Steve Blockstatic void handleFatalErrorInV8()
79d0825bca7fe65beaee391d30da42e937db621564Steve Block{
80d0825bca7fe65beaee391d30da42e937db621564Steve Block    // FIXME: We temporarily deal with V8 internal error situations
81d0825bca7fe65beaee391d30da42e937db621564Steve Block    // such as out-of-memory by crashing the renderer.
82d0825bca7fe65beaee391d30da42e937db621564Steve Block    CRASH();
83d0825bca7fe65beaee391d30da42e937db621564Steve Block}
84d0825bca7fe65beaee391d30da42e937db621564Steve Block
85d0825bca7fe65beaee391d30da42e937db621564Steve Blockstatic void reportFatalErrorInV8(const char* location, const char* message)
86d0825bca7fe65beaee391d30da42e937db621564Steve Block{
87d0825bca7fe65beaee391d30da42e937db621564Steve Block    // V8 is shutdown, we cannot use V8 api.
88d0825bca7fe65beaee391d30da42e937db621564Steve Block    // The only thing we can do is to disable JavaScript.
89d0825bca7fe65beaee391d30da42e937db621564Steve Block    // FIXME: clean up V8Proxy and disable JavaScript.
90dd8bb3de4f353a81954234999f1fea748aee2ea9Ben Murdoch    int memoryUsageMB = -1;
91dd8bb3de4f353a81954234999f1fea748aee2ea9Ben Murdoch#if PLATFORM(CHROMIUM)
92ab9e7a118cf1ea2e3a93dce683b2ded3e7291ddbBen Murdoch    memoryUsageMB = PlatformBridge::actualMemoryUsageMB();
93dd8bb3de4f353a81954234999f1fea748aee2ea9Ben Murdoch#endif
94dd8bb3de4f353a81954234999f1fea748aee2ea9Ben Murdoch    printf("V8 error: %s (%s).  Current memory usage: %d MB\n", message, location, memoryUsageMB);
95d0825bca7fe65beaee391d30da42e937db621564Steve Block    handleFatalErrorInV8();
96d0825bca7fe65beaee391d30da42e937db621564Steve Block}
97d0825bca7fe65beaee391d30da42e937db621564Steve Block
98ab9e7a118cf1ea2e3a93dce683b2ded3e7291ddbBen Murdochstatic void v8UncaughtExceptionHandler(v8::Handle<v8::Message> message, v8::Handle<v8::Value> data)
99ab9e7a118cf1ea2e3a93dce683b2ded3e7291ddbBen Murdoch{
100ab9e7a118cf1ea2e3a93dce683b2ded3e7291ddbBen Murdoch    // Use the frame where JavaScript is called from.
101ab9e7a118cf1ea2e3a93dce683b2ded3e7291ddbBen Murdoch    Frame* frame = V8Proxy::retrieveFrameForEnteredContext();
102ab9e7a118cf1ea2e3a93dce683b2ded3e7291ddbBen Murdoch    if (!frame)
103ab9e7a118cf1ea2e3a93dce683b2ded3e7291ddbBen Murdoch        return;
104ab9e7a118cf1ea2e3a93dce683b2ded3e7291ddbBen Murdoch
105ab9e7a118cf1ea2e3a93dce683b2ded3e7291ddbBen Murdoch    v8::Handle<v8::String> errorMessageString = message->Get();
106ab9e7a118cf1ea2e3a93dce683b2ded3e7291ddbBen Murdoch    ASSERT(!errorMessageString.IsEmpty());
107ab9e7a118cf1ea2e3a93dce683b2ded3e7291ddbBen Murdoch    String errorMessage = toWebCoreString(errorMessageString);
108ab9e7a118cf1ea2e3a93dce683b2ded3e7291ddbBen Murdoch
109ab9e7a118cf1ea2e3a93dce683b2ded3e7291ddbBen Murdoch    v8::Handle<v8::StackTrace> stackTrace = message->GetStackTrace();
110ab9e7a118cf1ea2e3a93dce683b2ded3e7291ddbBen Murdoch    RefPtr<ScriptCallStack> callStack;
111ab9e7a118cf1ea2e3a93dce683b2ded3e7291ddbBen Murdoch    // Currently stack trace is only collected when inspector is open.
112ab9e7a118cf1ea2e3a93dce683b2ded3e7291ddbBen Murdoch    if (!stackTrace.IsEmpty() && stackTrace->GetFrameCount() > 0)
113ab9e7a118cf1ea2e3a93dce683b2ded3e7291ddbBen Murdoch        callStack = createScriptCallStack(stackTrace, ScriptCallStack::maxCallStackSizeToCapture);
114ab9e7a118cf1ea2e3a93dce683b2ded3e7291ddbBen Murdoch
115ab9e7a118cf1ea2e3a93dce683b2ded3e7291ddbBen Murdoch    v8::Handle<v8::Value> resourceName = message->GetScriptResourceName();
116ab9e7a118cf1ea2e3a93dce683b2ded3e7291ddbBen Murdoch    bool useURL = resourceName.IsEmpty() || !resourceName->IsString();
117ab9e7a118cf1ea2e3a93dce683b2ded3e7291ddbBen Murdoch    Document* document = frame->document();
118ab9e7a118cf1ea2e3a93dce683b2ded3e7291ddbBen Murdoch    String resourceNameString = useURL ? document->url() : toWebCoreString(resourceName);
119ab9e7a118cf1ea2e3a93dce683b2ded3e7291ddbBen Murdoch    document->reportException(errorMessage, message->GetLineNumber(), resourceNameString, callStack);
120ab9e7a118cf1ea2e3a93dce683b2ded3e7291ddbBen Murdoch}
121ab9e7a118cf1ea2e3a93dce683b2ded3e7291ddbBen Murdoch
122d0825bca7fe65beaee391d30da42e937db621564Steve Block// Returns the owner frame pointer of a DOM wrapper object. It only works for
123d0825bca7fe65beaee391d30da42e937db621564Steve Block// these DOM objects requiring cross-domain access check.
124d0825bca7fe65beaee391d30da42e937db621564Steve Blockstatic Frame* getTargetFrame(v8::Local<v8::Object> host, v8::Local<v8::Value> data)
125d0825bca7fe65beaee391d30da42e937db621564Steve Block{
126d0825bca7fe65beaee391d30da42e937db621564Steve Block    Frame* target = 0;
127dcc8cf2e65d1aa555cce12431a16547e66b469eeSteve Block    WrapperTypeInfo* type = WrapperTypeInfo::unwrap(data);
128dcc8cf2e65d1aa555cce12431a16547e66b469eeSteve Block    if (V8DOMWindow::info.equals(type)) {
1298a0914b749bbe7da7768e07a7db5c6d4bb09472bSteve Block        v8::Handle<v8::Object> window = V8DOMWrapper::lookupDOMWrapper(V8DOMWindow::GetTemplate(), host);
130d0825bca7fe65beaee391d30da42e937db621564Steve Block        if (window.IsEmpty())
131d0825bca7fe65beaee391d30da42e937db621564Steve Block            return target;
132d0825bca7fe65beaee391d30da42e937db621564Steve Block
133d0825bca7fe65beaee391d30da42e937db621564Steve Block        DOMWindow* targetWindow = V8DOMWindow::toNative(window);
134d0825bca7fe65beaee391d30da42e937db621564Steve Block        target = targetWindow->frame();
135dcc8cf2e65d1aa555cce12431a16547e66b469eeSteve Block    } else if (V8History::info.equals(type)) {
136d0825bca7fe65beaee391d30da42e937db621564Steve Block        History* history = V8History::toNative(host);
137d0825bca7fe65beaee391d30da42e937db621564Steve Block        target = history->frame();
138dcc8cf2e65d1aa555cce12431a16547e66b469eeSteve Block    } else if (V8Location::info.equals(type)) {
139d0825bca7fe65beaee391d30da42e937db621564Steve Block        Location* location = V8Location::toNative(host);
140d0825bca7fe65beaee391d30da42e937db621564Steve Block        target = location->frame();
141d0825bca7fe65beaee391d30da42e937db621564Steve Block    }
142d0825bca7fe65beaee391d30da42e937db621564Steve Block    return target;
143d0825bca7fe65beaee391d30da42e937db621564Steve Block}
144d0825bca7fe65beaee391d30da42e937db621564Steve Block
145d0825bca7fe65beaee391d30da42e937db621564Steve Blockstatic void reportUnsafeJavaScriptAccess(v8::Local<v8::Object> host, v8::AccessType type, v8::Local<v8::Value> data)
146d0825bca7fe65beaee391d30da42e937db621564Steve Block{
147d0825bca7fe65beaee391d30da42e937db621564Steve Block    Frame* target = getTargetFrame(host, data);
148d0825bca7fe65beaee391d30da42e937db621564Steve Block    if (target)
149ab9e7a118cf1ea2e3a93dce683b2ded3e7291ddbBen Murdoch        V8Proxy::reportUnsafeAccessTo(target);
150d0825bca7fe65beaee391d30da42e937db621564Steve Block}
151d0825bca7fe65beaee391d30da42e937db621564Steve Block
152d0825bca7fe65beaee391d30da42e937db621564Steve BlockPassRefPtr<V8DOMWindowShell> V8DOMWindowShell::create(Frame* frame)
153d0825bca7fe65beaee391d30da42e937db621564Steve Block{
154d0825bca7fe65beaee391d30da42e937db621564Steve Block    return adoptRef(new V8DOMWindowShell(frame));
155d0825bca7fe65beaee391d30da42e937db621564Steve Block}
156d0825bca7fe65beaee391d30da42e937db621564Steve Block
157d0825bca7fe65beaee391d30da42e937db621564Steve BlockV8DOMWindowShell::V8DOMWindowShell(Frame* frame)
158d0825bca7fe65beaee391d30da42e937db621564Steve Block    : m_frame(frame)
159d0825bca7fe65beaee391d30da42e937db621564Steve Block{
160d0825bca7fe65beaee391d30da42e937db621564Steve Block}
161d0825bca7fe65beaee391d30da42e937db621564Steve Block
162d0825bca7fe65beaee391d30da42e937db621564Steve Blockbool V8DOMWindowShell::isContextInitialized()
163d0825bca7fe65beaee391d30da42e937db621564Steve Block{
164d0825bca7fe65beaee391d30da42e937db621564Steve Block    // m_context, m_global, and m_wrapperBoilerplates should
165d0825bca7fe65beaee391d30da42e937db621564Steve Block    // all be non-empty if if m_context is non-empty.
166d0825bca7fe65beaee391d30da42e937db621564Steve Block    ASSERT(m_context.IsEmpty() || !m_global.IsEmpty());
167d0825bca7fe65beaee391d30da42e937db621564Steve Block    return !m_context.IsEmpty();
168d0825bca7fe65beaee391d30da42e937db621564Steve Block}
169d0825bca7fe65beaee391d30da42e937db621564Steve Block
170d0825bca7fe65beaee391d30da42e937db621564Steve Blockvoid V8DOMWindowShell::disposeContextHandles()
171d0825bca7fe65beaee391d30da42e937db621564Steve Block{
172d0825bca7fe65beaee391d30da42e937db621564Steve Block    if (!m_context.IsEmpty()) {
173d0825bca7fe65beaee391d30da42e937db621564Steve Block        m_frame->loader()->client()->didDestroyScriptContextForFrame();
174d0825bca7fe65beaee391d30da42e937db621564Steve Block        m_context.Dispose();
175d0825bca7fe65beaee391d30da42e937db621564Steve Block        m_context.Clear();
176dcc8cf2e65d1aa555cce12431a16547e66b469eeSteve Block
177dcc8cf2e65d1aa555cce12431a16547e66b469eeSteve Block        // It's likely that disposing the context has created a lot of
178dcc8cf2e65d1aa555cce12431a16547e66b469eeSteve Block        // garbage. Notify V8 about this so it'll have a chance of cleaning
179dcc8cf2e65d1aa555cce12431a16547e66b469eeSteve Block        // it up when idle.
180dcc8cf2e65d1aa555cce12431a16547e66b469eeSteve Block        V8GCForContextDispose::instance().notifyContextDisposed();
181d0825bca7fe65beaee391d30da42e937db621564Steve Block    }
182d0825bca7fe65beaee391d30da42e937db621564Steve Block
183dcc8cf2e65d1aa555cce12431a16547e66b469eeSteve Block    WrapperBoilerplateMap::iterator it = m_wrapperBoilerplates.begin();
184dcc8cf2e65d1aa555cce12431a16547e66b469eeSteve Block    for (; it != m_wrapperBoilerplates.end(); ++it) {
185dcc8cf2e65d1aa555cce12431a16547e66b469eeSteve Block        v8::Persistent<v8::Object> wrapper = it->second;
186dcc8cf2e65d1aa555cce12431a16547e66b469eeSteve Block        wrapper.Dispose();
187dcc8cf2e65d1aa555cce12431a16547e66b469eeSteve Block        wrapper.Clear();
188d0825bca7fe65beaee391d30da42e937db621564Steve Block    }
189dcc8cf2e65d1aa555cce12431a16547e66b469eeSteve Block    m_wrapperBoilerplates.clear();
190d0825bca7fe65beaee391d30da42e937db621564Steve Block}
191d0825bca7fe65beaee391d30da42e937db621564Steve Block
192d0825bca7fe65beaee391d30da42e937db621564Steve Blockvoid V8DOMWindowShell::destroyGlobal()
193d0825bca7fe65beaee391d30da42e937db621564Steve Block{
194d0825bca7fe65beaee391d30da42e937db621564Steve Block    if (!m_global.IsEmpty()) {
195d0825bca7fe65beaee391d30da42e937db621564Steve Block#ifndef NDEBUG
196d0825bca7fe65beaee391d30da42e937db621564Steve Block        V8GCController::unregisterGlobalHandle(this, m_global);
197d0825bca7fe65beaee391d30da42e937db621564Steve Block#endif
198d0825bca7fe65beaee391d30da42e937db621564Steve Block        m_global.Dispose();
199d0825bca7fe65beaee391d30da42e937db621564Steve Block        m_global.Clear();
200d0825bca7fe65beaee391d30da42e937db621564Steve Block    }
201d0825bca7fe65beaee391d30da42e937db621564Steve Block}
202d0825bca7fe65beaee391d30da42e937db621564Steve Block
203d0825bca7fe65beaee391d30da42e937db621564Steve Blockvoid V8DOMWindowShell::clearForClose()
204d0825bca7fe65beaee391d30da42e937db621564Steve Block{
205d0825bca7fe65beaee391d30da42e937db621564Steve Block    if (!m_context.IsEmpty()) {
206d0825bca7fe65beaee391d30da42e937db621564Steve Block        v8::HandleScope handleScope;
207d0825bca7fe65beaee391d30da42e937db621564Steve Block
208d0825bca7fe65beaee391d30da42e937db621564Steve Block        clearDocumentWrapper();
209d0825bca7fe65beaee391d30da42e937db621564Steve Block        disposeContextHandles();
210d0825bca7fe65beaee391d30da42e937db621564Steve Block    }
211d0825bca7fe65beaee391d30da42e937db621564Steve Block}
212d0825bca7fe65beaee391d30da42e937db621564Steve Block
213d0825bca7fe65beaee391d30da42e937db621564Steve Blockvoid V8DOMWindowShell::clearForNavigation()
214d0825bca7fe65beaee391d30da42e937db621564Steve Block{
215d0825bca7fe65beaee391d30da42e937db621564Steve Block    if (!m_context.IsEmpty()) {
216d0825bca7fe65beaee391d30da42e937db621564Steve Block        v8::HandleScope handle;
217d0825bca7fe65beaee391d30da42e937db621564Steve Block        clearDocumentWrapper();
218d0825bca7fe65beaee391d30da42e937db621564Steve Block
219d0825bca7fe65beaee391d30da42e937db621564Steve Block        v8::Context::Scope contextScope(m_context);
220d0825bca7fe65beaee391d30da42e937db621564Steve Block
221d0825bca7fe65beaee391d30da42e937db621564Steve Block        // Clear the document wrapper cache before turning on access checks on
222d0825bca7fe65beaee391d30da42e937db621564Steve Block        // the old DOMWindow wrapper. This way, access to the document wrapper
223d0825bca7fe65beaee391d30da42e937db621564Steve Block        // will be protected by the security checks on the DOMWindow wrapper.
224d0825bca7fe65beaee391d30da42e937db621564Steve Block        clearDocumentWrapperCache();
225d0825bca7fe65beaee391d30da42e937db621564Steve Block
226d0825bca7fe65beaee391d30da42e937db621564Steve Block        // Turn on access check on the old DOMWindow wrapper.
2278a0914b749bbe7da7768e07a7db5c6d4bb09472bSteve Block        v8::Handle<v8::Object> wrapper = V8DOMWrapper::lookupDOMWrapper(V8DOMWindow::GetTemplate(), m_global);
228d0825bca7fe65beaee391d30da42e937db621564Steve Block        ASSERT(!wrapper.IsEmpty());
229d0825bca7fe65beaee391d30da42e937db621564Steve Block        wrapper->TurnOnAccessCheck();
230d0825bca7fe65beaee391d30da42e937db621564Steve Block
231d0825bca7fe65beaee391d30da42e937db621564Steve Block        // Separate the context from its global object.
232d0825bca7fe65beaee391d30da42e937db621564Steve Block        m_context->DetachGlobal();
233d0825bca7fe65beaee391d30da42e937db621564Steve Block
234d0825bca7fe65beaee391d30da42e937db621564Steve Block        disposeContextHandles();
235d0825bca7fe65beaee391d30da42e937db621564Steve Block    }
236d0825bca7fe65beaee391d30da42e937db621564Steve Block}
237d0825bca7fe65beaee391d30da42e937db621564Steve Block
238d0825bca7fe65beaee391d30da42e937db621564Steve Block// Create a new environment and setup the global object.
239d0825bca7fe65beaee391d30da42e937db621564Steve Block//
240d0825bca7fe65beaee391d30da42e937db621564Steve Block// The global object corresponds to a DOMWindow instance. However, to
241d0825bca7fe65beaee391d30da42e937db621564Steve Block// allow properties of the JS DOMWindow instance to be shadowed, we
242d0825bca7fe65beaee391d30da42e937db621564Steve Block// use a shadow object as the global object and use the JS DOMWindow
243d0825bca7fe65beaee391d30da42e937db621564Steve Block// instance as the prototype for that shadow object. The JS DOMWindow
244d0825bca7fe65beaee391d30da42e937db621564Steve Block// instance is undetectable from javascript code because the __proto__
245d0825bca7fe65beaee391d30da42e937db621564Steve Block// accessors skip that object.
246d0825bca7fe65beaee391d30da42e937db621564Steve Block//
247d0825bca7fe65beaee391d30da42e937db621564Steve Block// The shadow object and the DOMWindow instance are seen as one object
248d0825bca7fe65beaee391d30da42e937db621564Steve Block// from javascript. The javascript object that corresponds to a
249d0825bca7fe65beaee391d30da42e937db621564Steve Block// DOMWindow instance is the shadow object. When mapping a DOMWindow
250d0825bca7fe65beaee391d30da42e937db621564Steve Block// instance to a V8 object, we return the shadow object.
251d0825bca7fe65beaee391d30da42e937db621564Steve Block//
252d0825bca7fe65beaee391d30da42e937db621564Steve Block// To implement split-window, see
253d0825bca7fe65beaee391d30da42e937db621564Steve Block//   1) https://bugs.webkit.org/show_bug.cgi?id=17249
254d0825bca7fe65beaee391d30da42e937db621564Steve Block//   2) https://wiki.mozilla.org/Gecko:SplitWindow
255d0825bca7fe65beaee391d30da42e937db621564Steve Block//   3) https://bugzilla.mozilla.org/show_bug.cgi?id=296639
256d0825bca7fe65beaee391d30da42e937db621564Steve Block// we need to split the shadow object further into two objects:
257d0825bca7fe65beaee391d30da42e937db621564Steve Block// an outer window and an inner window. The inner window is the hidden
258d0825bca7fe65beaee391d30da42e937db621564Steve Block// prototype of the outer window. The inner window is the default
259d0825bca7fe65beaee391d30da42e937db621564Steve Block// global object of the context. A variable declared in the global
260d0825bca7fe65beaee391d30da42e937db621564Steve Block// scope is a property of the inner window.
261d0825bca7fe65beaee391d30da42e937db621564Steve Block//
262d0825bca7fe65beaee391d30da42e937db621564Steve Block// The outer window sticks to a Frame, it is exposed to JavaScript
263d0825bca7fe65beaee391d30da42e937db621564Steve Block// via window.window, window.self, window.parent, etc. The outer window
264d0825bca7fe65beaee391d30da42e937db621564Steve Block// has a security token which is the domain. The outer window cannot
265d0825bca7fe65beaee391d30da42e937db621564Steve Block// have its own properties. window.foo = 'x' is delegated to the
266d0825bca7fe65beaee391d30da42e937db621564Steve Block// inner window.
267d0825bca7fe65beaee391d30da42e937db621564Steve Block//
268d0825bca7fe65beaee391d30da42e937db621564Steve Block// When a frame navigates to a new page, the inner window is cut off
269d0825bca7fe65beaee391d30da42e937db621564Steve Block// the outer window, and the outer window identify is preserved for
270d0825bca7fe65beaee391d30da42e937db621564Steve Block// the frame. However, a new inner window is created for the new page.
271d0825bca7fe65beaee391d30da42e937db621564Steve Block// If there are JS code holds a closure to the old inner window,
272d0825bca7fe65beaee391d30da42e937db621564Steve Block// it won't be able to reach the outer window via its global object.
2735abb8606fa57c3ebfc8b3c3dbc3fa4a25d2ae306Iain Merrickbool V8DOMWindowShell::initContextIfNeeded()
274d0825bca7fe65beaee391d30da42e937db621564Steve Block{
275d0825bca7fe65beaee391d30da42e937db621564Steve Block    // Bail out if the context has already been initialized.
276d0825bca7fe65beaee391d30da42e937db621564Steve Block    if (!m_context.IsEmpty())
2775abb8606fa57c3ebfc8b3c3dbc3fa4a25d2ae306Iain Merrick        return false;
278d0825bca7fe65beaee391d30da42e937db621564Steve Block
27991f28d81678b7c10358c9352239d6fb5cffb9550Steve Block#ifdef ANDROID_INSTRUMENT
28091f28d81678b7c10358c9352239d6fb5cffb9550Steve Block    android::TimeCounter::start(android::TimeCounter::JavaScriptInitTimeCounter);
28191f28d81678b7c10358c9352239d6fb5cffb9550Steve Block#endif
28291f28d81678b7c10358c9352239d6fb5cffb9550Steve Block
283d0825bca7fe65beaee391d30da42e937db621564Steve Block    // Create a handle scope for all local handles.
284d0825bca7fe65beaee391d30da42e937db621564Steve Block    v8::HandleScope handleScope;
285d0825bca7fe65beaee391d30da42e937db621564Steve Block
286d0825bca7fe65beaee391d30da42e937db621564Steve Block    // Setup the security handlers and message listener. This only has
287d0825bca7fe65beaee391d30da42e937db621564Steve Block    // to be done once.
288d0825bca7fe65beaee391d30da42e937db621564Steve Block    static bool isV8Initialized = false;
289d0825bca7fe65beaee391d30da42e937db621564Steve Block    if (!isV8Initialized) {
290d0825bca7fe65beaee391d30da42e937db621564Steve Block        // Tells V8 not to call the default OOM handler, binding code
291d0825bca7fe65beaee391d30da42e937db621564Steve Block        // will handle it.
292d0825bca7fe65beaee391d30da42e937db621564Steve Block        v8::V8::IgnoreOutOfMemoryException();
293d0825bca7fe65beaee391d30da42e937db621564Steve Block        v8::V8::SetFatalErrorHandler(reportFatalErrorInV8);
294d0825bca7fe65beaee391d30da42e937db621564Steve Block
295d0825bca7fe65beaee391d30da42e937db621564Steve Block        v8::V8::SetGlobalGCPrologueCallback(&V8GCController::gcPrologue);
296d0825bca7fe65beaee391d30da42e937db621564Steve Block        v8::V8::SetGlobalGCEpilogueCallback(&V8GCController::gcEpilogue);
297d0825bca7fe65beaee391d30da42e937db621564Steve Block
298ab9e7a118cf1ea2e3a93dce683b2ded3e7291ddbBen Murdoch        v8::V8::AddMessageListener(&v8UncaughtExceptionHandler);
299d0825bca7fe65beaee391d30da42e937db621564Steve Block
300d0825bca7fe65beaee391d30da42e937db621564Steve Block        v8::V8::SetFailedAccessCheckCallbackFunction(reportUnsafeJavaScriptAccess);
301d0825bca7fe65beaee391d30da42e937db621564Steve Block
302d0825bca7fe65beaee391d30da42e937db621564Steve Block        isV8Initialized = true;
303d0825bca7fe65beaee391d30da42e937db621564Steve Block    }
304d0825bca7fe65beaee391d30da42e937db621564Steve Block
305d0825bca7fe65beaee391d30da42e937db621564Steve Block
306d0825bca7fe65beaee391d30da42e937db621564Steve Block    m_context = createNewContext(m_global, 0);
307d0825bca7fe65beaee391d30da42e937db621564Steve Block    if (m_context.IsEmpty())
3085abb8606fa57c3ebfc8b3c3dbc3fa4a25d2ae306Iain Merrick        return false;
309d0825bca7fe65beaee391d30da42e937db621564Steve Block
310d0825bca7fe65beaee391d30da42e937db621564Steve Block    v8::Local<v8::Context> v8Context = v8::Local<v8::Context>::New(m_context);
311d0825bca7fe65beaee391d30da42e937db621564Steve Block    v8::Context::Scope contextScope(v8Context);
312d0825bca7fe65beaee391d30da42e937db621564Steve Block
313d0825bca7fe65beaee391d30da42e937db621564Steve Block    // Store the first global object created so we can reuse it.
314d0825bca7fe65beaee391d30da42e937db621564Steve Block    if (m_global.IsEmpty()) {
315d0825bca7fe65beaee391d30da42e937db621564Steve Block        m_global = v8::Persistent<v8::Object>::New(v8Context->Global());
316d0825bca7fe65beaee391d30da42e937db621564Steve Block        // Bail out if allocation of the first global objects fails.
317d0825bca7fe65beaee391d30da42e937db621564Steve Block        if (m_global.IsEmpty()) {
318d0825bca7fe65beaee391d30da42e937db621564Steve Block            disposeContextHandles();
3195abb8606fa57c3ebfc8b3c3dbc3fa4a25d2ae306Iain Merrick            return false;
320d0825bca7fe65beaee391d30da42e937db621564Steve Block        }
321d0825bca7fe65beaee391d30da42e937db621564Steve Block#ifndef NDEBUG
322d0825bca7fe65beaee391d30da42e937db621564Steve Block        V8GCController::registerGlobalHandle(PROXY, this, m_global);
323d0825bca7fe65beaee391d30da42e937db621564Steve Block#endif
324d0825bca7fe65beaee391d30da42e937db621564Steve Block    }
325d0825bca7fe65beaee391d30da42e937db621564Steve Block
326dcc8cf2e65d1aa555cce12431a16547e66b469eeSteve Block    if (!installHiddenObjectPrototype(v8Context)) {
327d0825bca7fe65beaee391d30da42e937db621564Steve Block        disposeContextHandles();
3285abb8606fa57c3ebfc8b3c3dbc3fa4a25d2ae306Iain Merrick        return false;
329d0825bca7fe65beaee391d30da42e937db621564Steve Block    }
330d0825bca7fe65beaee391d30da42e937db621564Steve Block
331dcc8cf2e65d1aa555cce12431a16547e66b469eeSteve Block    if (!installDOMWindow(v8Context, m_frame->domWindow())) {
332d0825bca7fe65beaee391d30da42e937db621564Steve Block        disposeContextHandles();
3335abb8606fa57c3ebfc8b3c3dbc3fa4a25d2ae306Iain Merrick        return false;
334dcc8cf2e65d1aa555cce12431a16547e66b469eeSteve Block    }
335d0825bca7fe65beaee391d30da42e937db621564Steve Block
336d0825bca7fe65beaee391d30da42e937db621564Steve Block    updateDocument();
337d0825bca7fe65beaee391d30da42e937db621564Steve Block
338d0825bca7fe65beaee391d30da42e937db621564Steve Block    setSecurityToken();
339d0825bca7fe65beaee391d30da42e937db621564Steve Block
340d0825bca7fe65beaee391d30da42e937db621564Steve Block    m_frame->loader()->client()->didCreateScriptContextForFrame();
341d0825bca7fe65beaee391d30da42e937db621564Steve Block
342d0825bca7fe65beaee391d30da42e937db621564Steve Block    // FIXME: This is wrong. We should actually do this for the proper world once
343d0825bca7fe65beaee391d30da42e937db621564Steve Block    // we do isolated worlds the WebCore way.
344d0825bca7fe65beaee391d30da42e937db621564Steve Block    m_frame->loader()->dispatchDidClearWindowObjectInWorld(0);
34591f28d81678b7c10358c9352239d6fb5cffb9550Steve Block
34691f28d81678b7c10358c9352239d6fb5cffb9550Steve Block#ifdef ANDROID_INSTRUMENT
34791f28d81678b7c10358c9352239d6fb5cffb9550Steve Block    android::TimeCounter::record(android::TimeCounter::JavaScriptInitTimeCounter, __FUNCTION__);
34891f28d81678b7c10358c9352239d6fb5cffb9550Steve Block#endif
34992451d3c3cebc17dfa2908de5836d2dae50d4a42Iain Merrick
3505abb8606fa57c3ebfc8b3c3dbc3fa4a25d2ae306Iain Merrick    return true;
351d0825bca7fe65beaee391d30da42e937db621564Steve Block}
352d0825bca7fe65beaee391d30da42e937db621564Steve Block
353d0825bca7fe65beaee391d30da42e937db621564Steve Blockv8::Persistent<v8::Context> V8DOMWindowShell::createNewContext(v8::Handle<v8::Object> global, int extensionGroup)
354d0825bca7fe65beaee391d30da42e937db621564Steve Block{
355d0825bca7fe65beaee391d30da42e937db621564Steve Block    v8::Persistent<v8::Context> result;
356d0825bca7fe65beaee391d30da42e937db621564Steve Block
357d0825bca7fe65beaee391d30da42e937db621564Steve Block    // The activeDocumentLoader pointer could be 0 during frame shutdown.
358d0825bca7fe65beaee391d30da42e937db621564Steve Block    if (!m_frame->loader()->activeDocumentLoader())
359d0825bca7fe65beaee391d30da42e937db621564Steve Block        return result;
360d0825bca7fe65beaee391d30da42e937db621564Steve Block
361d0825bca7fe65beaee391d30da42e937db621564Steve Block    // Create a new environment using an empty template for the shadow
362d0825bca7fe65beaee391d30da42e937db621564Steve Block    // object. Reuse the global object if one has been created earlier.
363d0825bca7fe65beaee391d30da42e937db621564Steve Block    v8::Persistent<v8::ObjectTemplate> globalTemplate = V8DOMWindow::GetShadowObjectTemplate();
364d0825bca7fe65beaee391d30da42e937db621564Steve Block    if (globalTemplate.IsEmpty())
365d0825bca7fe65beaee391d30da42e937db621564Steve Block        return result;
366d0825bca7fe65beaee391d30da42e937db621564Steve Block
367d0825bca7fe65beaee391d30da42e937db621564Steve Block    // Used to avoid sleep calls in unload handlers.
368d0825bca7fe65beaee391d30da42e937db621564Steve Block    if (!V8Proxy::registeredExtensionWithV8(DateExtension::get()))
369a94275402997c11dd2e778633dacf4b7e630a35dBen Murdoch        V8Proxy::registerExtension(DateExtension::get());
370d0825bca7fe65beaee391d30da42e937db621564Steve Block
371d0825bca7fe65beaee391d30da42e937db621564Steve Block    // Dynamically tell v8 about our extensions now.
372d0825bca7fe65beaee391d30da42e937db621564Steve Block    const V8Extensions& extensions = V8Proxy::extensions();
373d0825bca7fe65beaee391d30da42e937db621564Steve Block    OwnArrayPtr<const char*> extensionNames(new const char*[extensions.size()]);
374d0825bca7fe65beaee391d30da42e937db621564Steve Block    int index = 0;
375d0825bca7fe65beaee391d30da42e937db621564Steve Block    for (size_t i = 0; i < extensions.size(); ++i) {
376a94275402997c11dd2e778633dacf4b7e630a35dBen Murdoch        // Ensure our date extension is always allowed.
377a94275402997c11dd2e778633dacf4b7e630a35dBen Murdoch        if (extensions[i] != DateExtension::get()
378a94275402997c11dd2e778633dacf4b7e630a35dBen Murdoch            && !m_frame->loader()->client()->allowScriptExtension(extensions[i]->name(), extensionGroup))
379d0825bca7fe65beaee391d30da42e937db621564Steve Block            continue;
380d0825bca7fe65beaee391d30da42e937db621564Steve Block
381a94275402997c11dd2e778633dacf4b7e630a35dBen Murdoch        extensionNames[index++] = extensions[i]->name();
382d0825bca7fe65beaee391d30da42e937db621564Steve Block    }
383d0825bca7fe65beaee391d30da42e937db621564Steve Block    v8::ExtensionConfiguration extensionConfiguration(index, extensionNames.get());
384d0825bca7fe65beaee391d30da42e937db621564Steve Block    result = v8::Context::New(&extensionConfiguration, globalTemplate, global);
385d0825bca7fe65beaee391d30da42e937db621564Steve Block
386d0825bca7fe65beaee391d30da42e937db621564Steve Block    return result;
387d0825bca7fe65beaee391d30da42e937db621564Steve Block}
388d0825bca7fe65beaee391d30da42e937db621564Steve Block
3898fecd9c9a62aa89fb44ed3142ba583dc7b8cbe29Andrei Popescuvoid V8DOMWindowShell::setContext(v8::Handle<v8::Context> context)
390d0825bca7fe65beaee391d30da42e937db621564Steve Block{
391dcc8cf2e65d1aa555cce12431a16547e66b469eeSteve Block    // if we already have a context, clear it before setting the new one.
392dcc8cf2e65d1aa555cce12431a16547e66b469eeSteve Block    if (!m_context.IsEmpty()) {
393dcc8cf2e65d1aa555cce12431a16547e66b469eeSteve Block        m_context.Dispose();
394dcc8cf2e65d1aa555cce12431a16547e66b469eeSteve Block        m_context.Clear();
395dcc8cf2e65d1aa555cce12431a16547e66b469eeSteve Block    }
396dcc8cf2e65d1aa555cce12431a16547e66b469eeSteve Block    m_context = v8::Persistent<v8::Context>::New(context);
397dcc8cf2e65d1aa555cce12431a16547e66b469eeSteve Block}
398d0825bca7fe65beaee391d30da42e937db621564Steve Block
399dcc8cf2e65d1aa555cce12431a16547e66b469eeSteve Blockbool V8DOMWindowShell::installDOMWindow(v8::Handle<v8::Context> context, DOMWindow* window)
400dcc8cf2e65d1aa555cce12431a16547e66b469eeSteve Block{
401d0825bca7fe65beaee391d30da42e937db621564Steve Block    // Create a new JS window object and use it as the prototype for the  shadow global object.
402dcc8cf2e65d1aa555cce12431a16547e66b469eeSteve Block    v8::Handle<v8::Function> windowConstructor = V8DOMWrapper::getConstructor(&V8DOMWindow::info, getHiddenObjectPrototype(context));
403d0825bca7fe65beaee391d30da42e937db621564Steve Block    v8::Local<v8::Object> jsWindow = SafeAllocation::newInstance(windowConstructor);
404d0825bca7fe65beaee391d30da42e937db621564Steve Block    // Bail out if allocation failed.
405d0825bca7fe65beaee391d30da42e937db621564Steve Block    if (jsWindow.IsEmpty())
406d0825bca7fe65beaee391d30da42e937db621564Steve Block        return false;
407d0825bca7fe65beaee391d30da42e937db621564Steve Block
408d0825bca7fe65beaee391d30da42e937db621564Steve Block    // Wrap the window.
409dcc8cf2e65d1aa555cce12431a16547e66b469eeSteve Block    V8DOMWrapper::setDOMWrapper(jsWindow, &V8DOMWindow::info, window);
410dcc8cf2e65d1aa555cce12431a16547e66b469eeSteve Block    V8DOMWrapper::setDOMWrapper(v8::Handle<v8::Object>::Cast(jsWindow->GetPrototype()), &V8DOMWindow::info, window);
411d0825bca7fe65beaee391d30da42e937db621564Steve Block
412d0825bca7fe65beaee391d30da42e937db621564Steve Block    window->ref();
413d0825bca7fe65beaee391d30da42e937db621564Steve Block    V8DOMWrapper::setJSWrapperForDOMObject(window, v8::Persistent<v8::Object>::New(jsWindow));
414d0825bca7fe65beaee391d30da42e937db621564Steve Block
415d0825bca7fe65beaee391d30da42e937db621564Steve Block    // Insert the window instance as the prototype of the shadow object.
416dcc8cf2e65d1aa555cce12431a16547e66b469eeSteve Block    v8::Handle<v8::Object> v8RealGlobal = v8::Handle<v8::Object>::Cast(context->Global()->GetPrototype());
417dcc8cf2e65d1aa555cce12431a16547e66b469eeSteve Block    V8DOMWrapper::setDOMWrapper(v8RealGlobal, &V8DOMWindow::info, window);
418dcc8cf2e65d1aa555cce12431a16547e66b469eeSteve Block    v8RealGlobal->SetPrototype(jsWindow);
419d0825bca7fe65beaee391d30da42e937db621564Steve Block    return true;
420d0825bca7fe65beaee391d30da42e937db621564Steve Block}
421d0825bca7fe65beaee391d30da42e937db621564Steve Block
4228a0914b749bbe7da7768e07a7db5c6d4bb09472bSteve Blockvoid V8DOMWindowShell::updateDocumentWrapper(v8::Handle<v8::Object> wrapper)
423d0825bca7fe65beaee391d30da42e937db621564Steve Block{
424d0825bca7fe65beaee391d30da42e937db621564Steve Block    clearDocumentWrapper();
425d0825bca7fe65beaee391d30da42e937db621564Steve Block
426d0825bca7fe65beaee391d30da42e937db621564Steve Block    ASSERT(m_document.IsEmpty());
4278a0914b749bbe7da7768e07a7db5c6d4bb09472bSteve Block    m_document = v8::Persistent<v8::Object>::New(wrapper);
428d0825bca7fe65beaee391d30da42e937db621564Steve Block#ifndef NDEBUG
429d0825bca7fe65beaee391d30da42e937db621564Steve Block    V8GCController::registerGlobalHandle(PROXY, this, m_document);
430d0825bca7fe65beaee391d30da42e937db621564Steve Block#endif
431d0825bca7fe65beaee391d30da42e937db621564Steve Block}
432d0825bca7fe65beaee391d30da42e937db621564Steve Block
433d0825bca7fe65beaee391d30da42e937db621564Steve Blockvoid V8DOMWindowShell::clearDocumentWrapper()
434d0825bca7fe65beaee391d30da42e937db621564Steve Block{
435d0825bca7fe65beaee391d30da42e937db621564Steve Block    if (!m_document.IsEmpty()) {
436d0825bca7fe65beaee391d30da42e937db621564Steve Block#ifndef NDEBUG
437d0825bca7fe65beaee391d30da42e937db621564Steve Block        V8GCController::unregisterGlobalHandle(this, m_document);
438d0825bca7fe65beaee391d30da42e937db621564Steve Block#endif
439d0825bca7fe65beaee391d30da42e937db621564Steve Block        m_document.Dispose();
440d0825bca7fe65beaee391d30da42e937db621564Steve Block        m_document.Clear();
441d0825bca7fe65beaee391d30da42e937db621564Steve Block    }
442d0825bca7fe65beaee391d30da42e937db621564Steve Block}
443d0825bca7fe65beaee391d30da42e937db621564Steve Block
444f486d19d62f1bc33246748b14b14a9dfa617b57fIain Merrickstatic void checkDocumentWrapper(v8::Handle<v8::Object> wrapper, Document* document)
445f486d19d62f1bc33246748b14b14a9dfa617b57fIain Merrick{
446f486d19d62f1bc33246748b14b14a9dfa617b57fIain Merrick    ASSERT(V8Document::toNative(wrapper) == document);
447f486d19d62f1bc33246748b14b14a9dfa617b57fIain Merrick    ASSERT(!document->isHTMLDocument() || (V8Document::toNative(v8::Handle<v8::Object>::Cast(wrapper->GetPrototype())) == document));
448f486d19d62f1bc33246748b14b14a9dfa617b57fIain Merrick}
449f486d19d62f1bc33246748b14b14a9dfa617b57fIain Merrick
450d0825bca7fe65beaee391d30da42e937db621564Steve Blockvoid V8DOMWindowShell::updateDocumentWrapperCache()
451d0825bca7fe65beaee391d30da42e937db621564Steve Block{
452d0825bca7fe65beaee391d30da42e937db621564Steve Block    v8::HandleScope handleScope;
453d0825bca7fe65beaee391d30da42e937db621564Steve Block    v8::Context::Scope contextScope(m_context);
454d0825bca7fe65beaee391d30da42e937db621564Steve Block
455d0825bca7fe65beaee391d30da42e937db621564Steve Block    // If the document has no frame, NodeToV8Object might get the
456d0825bca7fe65beaee391d30da42e937db621564Steve Block    // document wrapper for a document that is about to be deleted.
457d0825bca7fe65beaee391d30da42e937db621564Steve Block    // If the ForceSet below causes a garbage collection, the document
458d0825bca7fe65beaee391d30da42e937db621564Steve Block    // might get deleted and the global handle for the document
459d0825bca7fe65beaee391d30da42e937db621564Steve Block    // wrapper cleared. Using the cleared global handle will lead to
460d0825bca7fe65beaee391d30da42e937db621564Steve Block    // crashes. In this case we clear the cache and let the DOMWindow
461d0825bca7fe65beaee391d30da42e937db621564Steve Block    // accessor handle access to the document.
462d0825bca7fe65beaee391d30da42e937db621564Steve Block    if (!m_frame->document()->frame()) {
463d0825bca7fe65beaee391d30da42e937db621564Steve Block        clearDocumentWrapperCache();
464d0825bca7fe65beaee391d30da42e937db621564Steve Block        return;
465d0825bca7fe65beaee391d30da42e937db621564Steve Block    }
466d0825bca7fe65beaee391d30da42e937db621564Steve Block
4675e2bc6953fe6923165b8a5d7679939693a1d58d6Steve Block    v8::Handle<v8::Value> documentWrapper = toV8(m_frame->document());
468f486d19d62f1bc33246748b14b14a9dfa617b57fIain Merrick    ASSERT(documentWrapper == m_document || m_document.IsEmpty());
469f486d19d62f1bc33246748b14b14a9dfa617b57fIain Merrick    if (m_document.IsEmpty())
470f486d19d62f1bc33246748b14b14a9dfa617b57fIain Merrick        updateDocumentWrapper(v8::Handle<v8::Object>::Cast(documentWrapper));
471f486d19d62f1bc33246748b14b14a9dfa617b57fIain Merrick    checkDocumentWrapper(m_document, m_frame->document());
472d0825bca7fe65beaee391d30da42e937db621564Steve Block
473d0825bca7fe65beaee391d30da42e937db621564Steve Block    // If instantiation of the document wrapper fails, clear the cache
474d0825bca7fe65beaee391d30da42e937db621564Steve Block    // and let the DOMWindow accessor handle access to the document.
475d0825bca7fe65beaee391d30da42e937db621564Steve Block    if (documentWrapper.IsEmpty()) {
476d0825bca7fe65beaee391d30da42e937db621564Steve Block        clearDocumentWrapperCache();
477d0825bca7fe65beaee391d30da42e937db621564Steve Block        return;
478d0825bca7fe65beaee391d30da42e937db621564Steve Block    }
4798a0914b749bbe7da7768e07a7db5c6d4bb09472bSteve Block    ASSERT(documentWrapper->IsObject());
480d0825bca7fe65beaee391d30da42e937db621564Steve Block    m_context->Global()->ForceSet(v8::String::New("document"), documentWrapper, static_cast<v8::PropertyAttribute>(v8::ReadOnly | v8::DontDelete));
481d0825bca7fe65beaee391d30da42e937db621564Steve Block}
482d0825bca7fe65beaee391d30da42e937db621564Steve Block
483d0825bca7fe65beaee391d30da42e937db621564Steve Blockvoid V8DOMWindowShell::clearDocumentWrapperCache()
484d0825bca7fe65beaee391d30da42e937db621564Steve Block{
485d0825bca7fe65beaee391d30da42e937db621564Steve Block    ASSERT(!m_context.IsEmpty());
486d0825bca7fe65beaee391d30da42e937db621564Steve Block    m_context->Global()->ForceDelete(v8::String::New("document"));
487d0825bca7fe65beaee391d30da42e937db621564Steve Block}
488d0825bca7fe65beaee391d30da42e937db621564Steve Block
489d0825bca7fe65beaee391d30da42e937db621564Steve Blockvoid V8DOMWindowShell::setSecurityToken()
490d0825bca7fe65beaee391d30da42e937db621564Steve Block{
491d0825bca7fe65beaee391d30da42e937db621564Steve Block    Document* document = m_frame->document();
492d0825bca7fe65beaee391d30da42e937db621564Steve Block    // Setup security origin and security token.
493d0825bca7fe65beaee391d30da42e937db621564Steve Block    if (!document) {
494d0825bca7fe65beaee391d30da42e937db621564Steve Block        m_context->UseDefaultSecurityToken();
495d0825bca7fe65beaee391d30da42e937db621564Steve Block        return;
496d0825bca7fe65beaee391d30da42e937db621564Steve Block    }
497d0825bca7fe65beaee391d30da42e937db621564Steve Block
498d0825bca7fe65beaee391d30da42e937db621564Steve Block    // Ask the document's SecurityOrigin to generate a security token.
499d0825bca7fe65beaee391d30da42e937db621564Steve Block    // If two tokens are equal, then the SecurityOrigins canAccess each other.
500d0825bca7fe65beaee391d30da42e937db621564Steve Block    // If two tokens are not equal, then we have to call canAccess.
501d0825bca7fe65beaee391d30da42e937db621564Steve Block    // Note: we can't use the HTTPOrigin if it was set from the DOM.
502d0825bca7fe65beaee391d30da42e937db621564Steve Block    SecurityOrigin* origin = document->securityOrigin();
503d0825bca7fe65beaee391d30da42e937db621564Steve Block    String token;
504d0825bca7fe65beaee391d30da42e937db621564Steve Block    if (!origin->domainWasSetInDOM())
505d0825bca7fe65beaee391d30da42e937db621564Steve Block        token = document->securityOrigin()->toString();
506d0825bca7fe65beaee391d30da42e937db621564Steve Block
507d0825bca7fe65beaee391d30da42e937db621564Steve Block    // An empty or "null" token means we always have to call
508d0825bca7fe65beaee391d30da42e937db621564Steve Block    // canAccess. The toString method on securityOrigins returns the
509d0825bca7fe65beaee391d30da42e937db621564Steve Block    // string "null" for empty security origins and for security
510d0825bca7fe65beaee391d30da42e937db621564Steve Block    // origins that should only allow access to themselves. In this
511d0825bca7fe65beaee391d30da42e937db621564Steve Block    // case, we use the global object as the security token to avoid
512d0825bca7fe65beaee391d30da42e937db621564Steve Block    // calling canAccess when a script accesses its own objects.
513d0825bca7fe65beaee391d30da42e937db621564Steve Block    if (token.isEmpty() || token == "null") {
514d0825bca7fe65beaee391d30da42e937db621564Steve Block        m_context->UseDefaultSecurityToken();
515d0825bca7fe65beaee391d30da42e937db621564Steve Block        return;
516d0825bca7fe65beaee391d30da42e937db621564Steve Block    }
517d0825bca7fe65beaee391d30da42e937db621564Steve Block
518d0825bca7fe65beaee391d30da42e937db621564Steve Block    CString utf8Token = token.utf8();
519d0825bca7fe65beaee391d30da42e937db621564Steve Block    // NOTE: V8 does identity comparison in fast path, must use a symbol
520d0825bca7fe65beaee391d30da42e937db621564Steve Block    // as the security token.
521d0825bca7fe65beaee391d30da42e937db621564Steve Block    m_context->SetSecurityToken(v8::String::NewSymbol(utf8Token.data(), utf8Token.length()));
522d0825bca7fe65beaee391d30da42e937db621564Steve Block}
523d0825bca7fe65beaee391d30da42e937db621564Steve Block
524d0825bca7fe65beaee391d30da42e937db621564Steve Blockvoid V8DOMWindowShell::updateDocument()
525d0825bca7fe65beaee391d30da42e937db621564Steve Block{
526d0825bca7fe65beaee391d30da42e937db621564Steve Block    if (!m_frame->document())
527d0825bca7fe65beaee391d30da42e937db621564Steve Block        return;
528d0825bca7fe65beaee391d30da42e937db621564Steve Block
529d0825bca7fe65beaee391d30da42e937db621564Steve Block    if (m_global.IsEmpty())
530d0825bca7fe65beaee391d30da42e937db621564Steve Block        return;
531d0825bca7fe65beaee391d30da42e937db621564Steve Block
532d0825bca7fe65beaee391d30da42e937db621564Steve Block    // There is an existing JavaScript wrapper for the global object
533d0825bca7fe65beaee391d30da42e937db621564Steve Block    // of this frame. JavaScript code in other frames might hold a
534d0825bca7fe65beaee391d30da42e937db621564Steve Block    // reference to this wrapper. We eagerly initialize the JavaScript
535d0825bca7fe65beaee391d30da42e937db621564Steve Block    // context for the new document to make property access on the
536d0825bca7fe65beaee391d30da42e937db621564Steve Block    // global object wrapper succeed.
537d0825bca7fe65beaee391d30da42e937db621564Steve Block    initContextIfNeeded();
538d0825bca7fe65beaee391d30da42e937db621564Steve Block
539d0825bca7fe65beaee391d30da42e937db621564Steve Block    // Bail out if context initialization failed.
540d0825bca7fe65beaee391d30da42e937db621564Steve Block    if (m_context.IsEmpty())
541d0825bca7fe65beaee391d30da42e937db621564Steve Block        return;
542d0825bca7fe65beaee391d30da42e937db621564Steve Block
543d0825bca7fe65beaee391d30da42e937db621564Steve Block    // We have a new document and we need to update the cache.
544d0825bca7fe65beaee391d30da42e937db621564Steve Block    updateDocumentWrapperCache();
545d0825bca7fe65beaee391d30da42e937db621564Steve Block
546d0825bca7fe65beaee391d30da42e937db621564Steve Block    updateSecurityOrigin();
547d0825bca7fe65beaee391d30da42e937db621564Steve Block}
548d0825bca7fe65beaee391d30da42e937db621564Steve Block
549f486d19d62f1bc33246748b14b14a9dfa617b57fIain Merrickv8::Handle<v8::Value> getter(v8::Local<v8::String> property, const v8::AccessorInfo& info)
550f486d19d62f1bc33246748b14b14a9dfa617b57fIain Merrick{
551f486d19d62f1bc33246748b14b14a9dfa617b57fIain Merrick    // FIXME(antonm): consider passing AtomicStringImpl directly.
552f486d19d62f1bc33246748b14b14a9dfa617b57fIain Merrick    AtomicString name = v8StringToAtomicWebCoreString(property);
553f486d19d62f1bc33246748b14b14a9dfa617b57fIain Merrick    HTMLDocument* htmlDocument = V8HTMLDocument::toNative(info.Holder());
554f486d19d62f1bc33246748b14b14a9dfa617b57fIain Merrick    ASSERT(htmlDocument);
555f486d19d62f1bc33246748b14b14a9dfa617b57fIain Merrick    v8::Handle<v8::Value> result = V8HTMLDocument::GetNamedProperty(htmlDocument, name);
556f486d19d62f1bc33246748b14b14a9dfa617b57fIain Merrick    if (!result.IsEmpty())
557f486d19d62f1bc33246748b14b14a9dfa617b57fIain Merrick        return result;
558f486d19d62f1bc33246748b14b14a9dfa617b57fIain Merrick    v8::Handle<v8::Value> prototype = info.Holder()->GetPrototype();
559f486d19d62f1bc33246748b14b14a9dfa617b57fIain Merrick    if (prototype->IsObject())
560f486d19d62f1bc33246748b14b14a9dfa617b57fIain Merrick        return prototype.As<v8::Object>()->Get(property);
561f486d19d62f1bc33246748b14b14a9dfa617b57fIain Merrick    return v8::Undefined();
562f486d19d62f1bc33246748b14b14a9dfa617b57fIain Merrick}
563f486d19d62f1bc33246748b14b14a9dfa617b57fIain Merrick
564f486d19d62f1bc33246748b14b14a9dfa617b57fIain Merrickvoid V8DOMWindowShell::namedItemAdded(HTMLDocument* doc, const AtomicString& name)
565f486d19d62f1bc33246748b14b14a9dfa617b57fIain Merrick{
566f486d19d62f1bc33246748b14b14a9dfa617b57fIain Merrick    initContextIfNeeded();
567f486d19d62f1bc33246748b14b14a9dfa617b57fIain Merrick
568f486d19d62f1bc33246748b14b14a9dfa617b57fIain Merrick    v8::HandleScope handleScope;
569f486d19d62f1bc33246748b14b14a9dfa617b57fIain Merrick    v8::Context::Scope contextScope(m_context);
570f486d19d62f1bc33246748b14b14a9dfa617b57fIain Merrick
571f486d19d62f1bc33246748b14b14a9dfa617b57fIain Merrick    ASSERT(!m_document.IsEmpty());
572f486d19d62f1bc33246748b14b14a9dfa617b57fIain Merrick    checkDocumentWrapper(m_document, doc);
573f486d19d62f1bc33246748b14b14a9dfa617b57fIain Merrick    m_document->SetAccessor(v8String(name), getter);
574f486d19d62f1bc33246748b14b14a9dfa617b57fIain Merrick}
575f486d19d62f1bc33246748b14b14a9dfa617b57fIain Merrick
576f486d19d62f1bc33246748b14b14a9dfa617b57fIain Merrickvoid V8DOMWindowShell::namedItemRemoved(HTMLDocument* doc, const AtomicString& name)
577f486d19d62f1bc33246748b14b14a9dfa617b57fIain Merrick{
578f486d19d62f1bc33246748b14b14a9dfa617b57fIain Merrick}
579f486d19d62f1bc33246748b14b14a9dfa617b57fIain Merrick
580d0825bca7fe65beaee391d30da42e937db621564Steve Blockvoid V8DOMWindowShell::updateSecurityOrigin()
581d0825bca7fe65beaee391d30da42e937db621564Steve Block{
582d0825bca7fe65beaee391d30da42e937db621564Steve Block    v8::HandleScope scope;
583d0825bca7fe65beaee391d30da42e937db621564Steve Block    setSecurityToken();
584d0825bca7fe65beaee391d30da42e937db621564Steve Block}
585d0825bca7fe65beaee391d30da42e937db621564Steve Block
586d0825bca7fe65beaee391d30da42e937db621564Steve Blockv8::Handle<v8::Value> V8DOMWindowShell::getHiddenObjectPrototype(v8::Handle<v8::Context> context)
587d0825bca7fe65beaee391d30da42e937db621564Steve Block{
588d0825bca7fe65beaee391d30da42e937db621564Steve Block    return context->Global()->GetHiddenValue(V8HiddenPropertyName::objectPrototype());
589d0825bca7fe65beaee391d30da42e937db621564Steve Block}
590d0825bca7fe65beaee391d30da42e937db621564Steve Block
591dcc8cf2e65d1aa555cce12431a16547e66b469eeSteve Blockbool V8DOMWindowShell::installHiddenObjectPrototype(v8::Handle<v8::Context> context)
592d0825bca7fe65beaee391d30da42e937db621564Steve Block{
593d0825bca7fe65beaee391d30da42e937db621564Steve Block    v8::Handle<v8::String> objectString = v8::String::New("Object");
594d0825bca7fe65beaee391d30da42e937db621564Steve Block    v8::Handle<v8::String> prototypeString = v8::String::New("prototype");
595d0825bca7fe65beaee391d30da42e937db621564Steve Block    v8::Handle<v8::String> hiddenObjectPrototypeString = V8HiddenPropertyName::objectPrototype();
596d0825bca7fe65beaee391d30da42e937db621564Steve Block    // Bail out if allocation failed.
597d0825bca7fe65beaee391d30da42e937db621564Steve Block    if (objectString.IsEmpty() || prototypeString.IsEmpty() || hiddenObjectPrototypeString.IsEmpty())
598dcc8cf2e65d1aa555cce12431a16547e66b469eeSteve Block        return false;
599d0825bca7fe65beaee391d30da42e937db621564Steve Block
600d0825bca7fe65beaee391d30da42e937db621564Steve Block    v8::Handle<v8::Object> object = v8::Handle<v8::Object>::Cast(context->Global()->Get(objectString));
601dcc8cf2e65d1aa555cce12431a16547e66b469eeSteve Block    // Bail out if fetching failed.
602dcc8cf2e65d1aa555cce12431a16547e66b469eeSteve Block    if (object.IsEmpty())
603dcc8cf2e65d1aa555cce12431a16547e66b469eeSteve Block        return false;
604d0825bca7fe65beaee391d30da42e937db621564Steve Block    v8::Handle<v8::Value> objectPrototype = object->Get(prototypeString);
605dcc8cf2e65d1aa555cce12431a16547e66b469eeSteve Block    // Bail out if fetching failed.
606dcc8cf2e65d1aa555cce12431a16547e66b469eeSteve Block    if (objectPrototype.IsEmpty())
607dcc8cf2e65d1aa555cce12431a16547e66b469eeSteve Block        return false;
608d0825bca7fe65beaee391d30da42e937db621564Steve Block
609d0825bca7fe65beaee391d30da42e937db621564Steve Block    context->Global()->SetHiddenValue(hiddenObjectPrototypeString, objectPrototype);
610dcc8cf2e65d1aa555cce12431a16547e66b469eeSteve Block
611dcc8cf2e65d1aa555cce12431a16547e66b469eeSteve Block    return true;
612d0825bca7fe65beaee391d30da42e937db621564Steve Block}
613d0825bca7fe65beaee391d30da42e937db621564Steve Block
614dcc8cf2e65d1aa555cce12431a16547e66b469eeSteve Blockv8::Local<v8::Object> V8DOMWindowShell::createWrapperFromCacheSlowCase(WrapperTypeInfo* type)
615d0825bca7fe65beaee391d30da42e937db621564Steve Block{
616d0825bca7fe65beaee391d30da42e937db621564Steve Block    // Not in cache.
617d0825bca7fe65beaee391d30da42e937db621564Steve Block    initContextIfNeeded();
618d0825bca7fe65beaee391d30da42e937db621564Steve Block    v8::Context::Scope scope(m_context);
619d0825bca7fe65beaee391d30da42e937db621564Steve Block    v8::Local<v8::Function> function = V8DOMWrapper::getConstructor(type, getHiddenObjectPrototype(m_context));
620d0825bca7fe65beaee391d30da42e937db621564Steve Block    v8::Local<v8::Object> instance = SafeAllocation::newInstance(function);
621d0825bca7fe65beaee391d30da42e937db621564Steve Block    if (!instance.IsEmpty()) {
622dcc8cf2e65d1aa555cce12431a16547e66b469eeSteve Block        m_wrapperBoilerplates.set(type, v8::Persistent<v8::Object>::New(instance));
623d0825bca7fe65beaee391d30da42e937db621564Steve Block        return instance->Clone();
624d0825bca7fe65beaee391d30da42e937db621564Steve Block    }
625d0825bca7fe65beaee391d30da42e937db621564Steve Block    return notHandledByInterceptor();
626d0825bca7fe65beaee391d30da42e937db621564Steve Block}
627d0825bca7fe65beaee391d30da42e937db621564Steve Block
628cad810f21b803229eb11403f9209855525a25d57Steve Blockvoid V8DOMWindowShell::setLocation(DOMWindow* window, const String& locationString)
629d0825bca7fe65beaee391d30da42e937db621564Steve Block{
630cad810f21b803229eb11403f9209855525a25d57Steve Block    State<V8Binding>* state = V8BindingState::Only();
631cad810f21b803229eb11403f9209855525a25d57Steve Block    window->setLocation(locationString, state->activeWindow(), state->firstWindow());
632d0825bca7fe65beaee391d30da42e937db621564Steve Block}
633d0825bca7fe65beaee391d30da42e937db621564Steve Block
634d0825bca7fe65beaee391d30da42e937db621564Steve Block} // WebCore
635