Add access checks to V8WrapperInstationScope.

Source/bindings/core/v8/V8DOMWrapper.h

Index: Source/bindings/core/v8/V8DOMWrapper.h
diff --git a/Source/bindings/core/v8/V8DOMWrapper.h b/Source/bindings/core/v8/V8DOMWrapper.h
index 229f89d6bb5f6af9761ce8249f1f7a5a6e81cd9f..36847e08d5d13b9e40680205bbfbc7fb4f6b4f12 100644
--- a/Source/bindings/core/v8/V8DOMWrapper.h
+++ b/Source/bindings/core/v8/V8DOMWrapper.h
@@ -31,8 +31,10 @@
 #ifndef V8DOMWrapper_h
 #define V8DOMWrapper_h
 
+#include "bindings/core/v8/BindingSecurity.h"
 #include "bindings/core/v8/DOMDataStore.h"
 #include "bindings/core/v8/ScriptWrappable.h"
+#include "bindings/core/v8/V8Binding.h"
 #include "wtf/PassRefPtr.h"
 #include "wtf/RawPtr.h"
 #include "wtf/text/AtomicString.h"
@@ -108,7 +110,7 @@ inline v8::Local<v8::Object> V8DOMWrapper::associateObjectWithWrapper(v8::Isolat
 class V8WrapperInstantiationScope {
     STACK_ALLOCATED();
 public:
-    V8WrapperInstantiationScope(v8::Local<v8::Object> creationContext, v8::Isolate* isolate)
+    V8WrapperInstantiationScope(v8::Local<v8::Object> creationContext, v8::Isolate* isolate, bool withSecurityCheck = true)
         : m_didEnterContext(false)
         , m_context(isolate->GetCurrentContext())
     {
@@ -121,6 +123,8 @@ public:
         // is different from the context that we are about to enter.
         if (contextForWrapper == m_context)

[haraken, 2015/12/22 07:17:51]

epertoso@ and jochen@: I'm getting a bit confused. In what scenario can
info.Holder()->CreationContext() be different from isolate->GetCurrentContext()?

Imagine that you have a main frame and an iframe. Imagine that you execute the
following code in the main frame.

- If you call iframe.contentDocument, in the binding callback for
contentDocument, which context do the isolate->GetCurrentContext and the
info.Holder()->CreationContext return?

(My guess is that both return the iframe's context.)

- If you call iframe.contentDocument.createElement(), in the binding callback
for createElement(), which context do the isolate->GetCurrentContext and the
info.Holder()->CreationContext return?

(My guess is that both return the iframe's context.)

- In what scenario, do the isolate->GetCurrentContext and the
info.Holder()->CreationContext return different contexts?

             return;
+        if (withSecurityCheck)
+            SecurityCheck(isolate, contextForWrapper);
         m_context = v8::Local<v8::Context>::New(isolate, contextForWrapper);
         m_didEnterContext = true;
         m_context->Enter();
@@ -136,6 +140,8 @@ public:
     v8::Local<v8::Context> context() const { return m_context; }
 
 private:
+    void SecurityCheck(v8::Isolate*, v8::Local<v8::Context> contextForWrapper);
+
     bool m_didEnterContext;
     v8::Local<v8::Context> m_context;
 };