add access checks to receivers on function callbacks

src/objects.cc

Index: src/objects.cc
diff --git a/src/objects.cc b/src/objects.cc
index 23f2eb39de9201ee53c46f996bfe5e3621d8af3d..720af0864a1fd19fa788bf929eede2685d602f27 100644
--- a/src/objects.cc
+++ b/src/objects.cc
@@ -241,21 +241,28 @@ bool FunctionTemplateInfo::IsTemplateFor(Map* map) {
 
 
 // TODO(dcarney): CallOptimization duplicates this logic, merge.
-Object* FunctionTemplateInfo::GetCompatibleReceiver(Isolate* isolate,
-                                                    Object* receiver) {
+Handle<Object> FunctionTemplateInfo::GetCompatibleReceiver(
+    Isolate* isolate, Handle<Object> receiver, bool is_construct) {
   // API calls are only supported with JSObject receivers.
-  if (!receiver->IsJSObject()) return isolate->heap()->null_value();
+  if (!receiver->IsJSObject()) return isolate->factory()->null_value();
+  auto js_receiver = Handle<JSObject>::cast(receiver);
+  if (!is_construct && js_receiver->IsAccessCheckNeeded() &&
+      !isolate->MayAccess(js_receiver)) {

[Toon Verwaest, 2015/03/25 15:28:24]

This isn't good enough, as the IC you'll compile is available cross-context. If
code from another origin shares the same IC, they'll get access if it was
initialized for the first context. You need to dynamically verify access /
context.

+    return isolate->factory()->null_value();
+  }
   Object* recv_type = this->signature();
   // No signature, return holder.
   if (recv_type->IsUndefined()) return receiver;
   FunctionTemplateInfo* signature = FunctionTemplateInfo::cast(recv_type);
   // Check the receiver.
-  for (PrototypeIterator iter(isolate, receiver,
+  for (PrototypeIterator iter(isolate, *receiver,
                               PrototypeIterator::START_AT_RECEIVER);
        !iter.IsAtEnd(PrototypeIterator::END_AT_NON_HIDDEN); iter.Advance()) {
-    if (signature->IsTemplateFor(iter.GetCurrent())) return iter.GetCurrent();
+    if (signature->IsTemplateFor(iter.GetCurrent())) {
+      return Handle<Object>(iter.GetCurrent(), isolate);
+    }
   }
-  return isolate->heap()->null_value();
+  return isolate->factory()->null_value();
 }