Modifies WindowProxy::setSecurityToken so that the frame's SecurityOrigin is taken into account whe…

Source/bindings/core/v8/ScriptController.cpp

 /*
  * Copyright (C) 2008, 2009 Google Inc. All rights reserved.
  * Copyright (C) 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2014 Opera Software ASA. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
@@ skipping 123 matching lines @@
 void ScriptController::clearForClose()
 {
     double start = currentTime();
     m_windowProxyManager->clearForClose();
     Platform::current()->histogramCustomCounts("WebCore.ScriptController.clearForClose", (currentTime() - start) * 1000, 0, 10000, 50);
 }
 
 void ScriptController::updateSecurityOrigin(SecurityOrigin* origin)
 {
     m_windowProxyManager->mainWorldProxy()->updateSecurityOrigin(origin);
+    Vector<std::pair<ScriptState*, SecurityOrigin*>> isolatedContexts;
+    m_windowProxyManager->collectIsolatedContexts(isolatedContexts);
+    for (auto isolatedContext : isolatedContexts) {
+        WindowProxy* proxy = m_windowProxyManager->existingWindowProxy(isolatedContext.first->world());

[haraken, 2015/09/14 15:28:59]

I think we should call windowProxy, not existingWindowProxy.

Note that existingWindowProxy is for devtools only (see the comment on
WindowProxyManager::existingWindowProxy).

[epertoso, 2015/09/14 15:59:37]

But windowProxy() will create a proxy if there isn't one already. Do we want
this?

[haraken, 2015/09/14 23:46:04]

I can't come up with a scenario where the isolated world doesn't have a
WindowProxy when we reach here.

Even if it happens, a right thing would be to create a WindowProxy and set a
security origin on it. Otherwise, the WindowProxy will be instantiated without
setting the security origin, which seems wrong.

So, calling windowProxy() would be a right thing here, I think.

[epertoso, 2015/09/15 08:24:58]

Done.

+        if (proxy)
+            proxy->setSecurityToken(isolatedContext.second);

[haraken, 2015/09/14 15:28:59]

How about calling updateSecurityOrigin, just like we do for the main world proxy
at line 143?

[epertoso, 2015/09/14 15:59:37]

updateSecurityOrigin has an ASSERT that implies it's expected to be called only
for the main world.

We could remove the assert, if you prefer.

[haraken, 2015/09/14 23:46:04]

I think it does make sense to remove the assert now, since we're adding the
security origin to isolated worlds in this CL.

[epertoso, 2015/09/15 08:24:58]

Done.

+    }
 }
 
 v8::MaybeLocal<v8::Value> ScriptController::callFunction(v8::Local<v8::Function> function, v8::Local<v8::Value> receiver, int argc, v8::Local<v8::Value> info[])
 {
     // Keep LocalFrame (and therefore ScriptController) alive.
     RefPtrWillBeRawPtr<LocalFrame> protect(frame());
     return ScriptController::callFunction(frame()->document(), function, receiver, argc, info, isolate());
 }
 
 v8::MaybeLocal<v8::Value> ScriptController::callFunction(ExecutionContext* context, v8::Local<v8::Function> function, v8::Local<v8::Value> receiver, int argc, v8::Local<v8::Value> info[], v8::Isolate* isolate)
@@ skipping 439 matching lines @@
         for (size_t i = 0; i < resultArray->Length(); ++i) {
             v8::Local<v8::Value> value;
             if (!resultArray->Get(scriptState->context(), i).ToLocal(&value))
                 return;
             results->append(value);
         }
     }
 }
 
 } // namespace blink