[bindings] add support for integer-indexed @@iterator

third_party/WebKit/Source/bindings/templates/interface_base.cpp

 {% include 'copyright_block.txt' %}
 #include "config.h"
 {% filter conditional(conditional_string) %}
 #include "{{v8_class_or_partial}}.h"
 
 {% for filename in cpp_includes if filename != '%s.h' % cpp_class_or_partial %}
 #include "{{filename}}"
 {% endfor %}
 
 namespace blink {
@@ skipping 330 matching lines @@
     ALLOW_UNUSED_LOCAL(instanceTemplate);
     v8::Local<v8::ObjectTemplate> prototypeTemplate = functionTemplate->PrototypeTemplate();
     ALLOW_UNUSED_LOCAL(prototypeTemplate);
     {% if custom_registration_methods %}
     ExecutionContext* context = currentExecutionContext(isolate);
     ALLOW_UNUSED_LOCAL(context);
     {% endif %}
     {% if has_access_check_callbacks %}
     instanceTemplate->SetAccessCheckCallbacks({{cpp_class}}V8Internal::namedSecurityCheck, {{cpp_class}}V8Internal::indexedSecurityCheck, v8::External::New(isolate, const_cast<WrapperTypeInfo*>(&{{v8_class}}::wrapperTypeInfo)));
     {% endif %}
+    {% if has_array_iterator %}
+    {% filter runtime_enabled('RuntimeEnabledFeatures::iterableCollectionsEnabled') %}
+    {% if is_global %}
+    instanceTemplate->Set(v8::Symbol::GetIterator(isolate), v8::Array::GetValuesIterator(isolate), v8::DontEnum);

[Toon Verwaest, 2015/10/14 10:59:42]

Instance templates that are supposed to be instantiated in multiple native
contexts cannot have non-primitive members. Otherwise there's a cross-context
leak between the context that the values are taken from, and the context they
are injected into. In this case the .constructor (Function) from the context
active during template creation leaks, creating a full UXSS between that context
and any context that gets global objects afterwards. (Which provides a channel
between all contexts and origins).

[caitp (gmail), 2015/10/14 12:32:03]

It sounds like the non-global interfaces could also have this problem, I'm not
sure I understand why they don't.

What would be an alternative strategy that people could live with?

+    {% else %}
+    prototypeTemplate->Set(v8::Symbol::GetIterator(isolate), v8::Array::GetValuesIterator(isolate), v8::DontEnum);
+    {% endif %}
+    {% endfilter %}{# runtime_enabled() #}
+    {% endif %}
     {% for attribute in attributes
        if attribute.runtime_enabled_function and
           not attribute.exposed_test %}
     {% filter conditional(attribute.conditional_string) %}
     if ({{attribute.runtime_enabled_function}}()) {
         {% if attribute.is_data_type_property %}
         const V8DOMConfiguration::AttributeConfiguration attributeConfiguration = \
         {{attribute_configuration(attribute)}};
         V8DOMConfiguration::installAttribute(isolate, instanceTemplate, prototypeTemplate, attributeConfiguration);
         {% else %}
@@ skipping 84 matching lines @@
 {% endfor %}
 {% for attribute in attributes if attribute.is_implemented_in_private_script %}
 {{attribute_getter_implemented_in_private_script(attribute)}}
 {% if attribute.has_setter %}
 {{attribute_setter_implemented_in_private_script(attribute)}}
 {% endif %}
 {% endfor %}
 {% block partial_interface %}{% endblock %}
 } // namespace blink
 {% endfilter %}