FrameLoader: Prevent reentrancy on dispatchDidClearWindowObjectInMainWorld.

Source/core/loader/FrameLoader.cpp

 /*
  * Copyright (C) 2006, 2007, 2008, 2009, 2010, 2011 Apple Inc. All rights reserved.
  * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
  * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  * Copyright (C) 2008 Alp Toker <alp@atoker.com>
  * Copyright (C) Research In Motion Limited 2009. All rights reserved.
  * Copyright (C) 2011 Kris Jordan <krisjordan@gmail.com>
  * Copyright (C) 2011 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ skipping 99 matching lines @@
 
 FrameLoader::FrameLoader(LocalFrame* frame)
     : m_frame(frame)
     , m_progressTracker(ProgressTracker::create(frame))
     , m_loadType(FrameLoadTypeStandard)
     , m_inStopAllLoaders(false)
     , m_checkTimer(this, &FrameLoader::checkTimerFired)
     , m_didAccessInitialDocument(false)
     , m_didAccessInitialDocumentTimer(this, &FrameLoader::didAccessInitialDocumentTimerFired)
     , m_forcedSandboxFlags(SandboxNone)
+    , m_dispatchingDidClearWindowObjectInMainWorld(false)
 {
 }
 
 FrameLoader::~FrameLoader()
 {
     // Verify that this FrameLoader has been detached.
     ASSERT(!m_progressTracker);
 }
 
 DEFINE_TRACE(FrameLoader)
@@ skipping 1238 matching lines @@
     // We just cleared the document, not the entire window object, but for the
     // embedder that's close enough.
     client()->dispatchDidClearWindowObjectInMainWorld();
 }
 
 void FrameLoader::dispatchDidClearWindowObjectInMainWorld()
 {
     if (!m_frame->script().canExecuteScripts(NotAboutToExecuteScript))
         return;
 
+    if (m_dispatchingDidClearWindowObjectInMainWorld)
+        return;
+    m_dispatchingDidClearWindowObjectInMainWorld = true;

[Nate Chapin, 2015/05/29 21:28:00]

TemporaryChange<bool>
inDidClearWindowObject(m_dispatchingDidClearWindowObjectInMainWorld, true);

[tommycli, 2015/05/29 21:36:44]

Done.

     client()->dispatchDidClearWindowObjectInMainWorld();
+    m_dispatchingDidClearWindowObjectInMainWorld = false;
 }
 
 SandboxFlags FrameLoader::effectiveSandboxFlags() const
 {
     SandboxFlags flags = m_forcedSandboxFlags;
     if (FrameOwner* frameOwner = m_frame->owner())
         flags |= frameOwner->sandboxFlags();
     // Frames need to inherit the sandbox flags of their parent frame.
     if (Frame* parentFrame = m_frame->tree().parent())
         flags |= parentFrame->securityContext()->sandboxFlags();
@@ skipping 40 matching lines @@
     // FIXME: We need a way to propagate insecure requests policy flags to
     // out-of-process frames. For now, we'll always use default behavior.
     if (!parentFrame->isLocalFrame())
         return nullptr;
 
     ASSERT(toLocalFrame(parentFrame)->document());
     return toLocalFrame(parentFrame)->document()->insecureNavigationsToUpgrade();
 }
 
 } // namespace blink