[bindings] add support for integer-indexed @@iterator

third_party/WebKit/Source/bindings/templates/interface_base.cpp

Index: third_party/WebKit/Source/bindings/templates/interface_base.cpp
diff --git a/third_party/WebKit/Source/bindings/templates/interface_base.cpp b/third_party/WebKit/Source/bindings/templates/interface_base.cpp
index 21773c0cd753af0fa4df6c63f6d0f7c2edca765a..4e34627e0883d24487066f8bd87d3ca6ce04eb97 100644
--- a/third_party/WebKit/Source/bindings/templates/interface_base.cpp
+++ b/third_party/WebKit/Source/bindings/templates/interface_base.cpp
@@ -348,6 +348,15 @@ static void install{{v8_class}}Template(v8::Local<v8::FunctionTemplate> function
     {% if has_access_check_callbacks %}
     instanceTemplate->SetAccessCheckCallbacks({{cpp_class}}V8Internal::namedSecurityCheck, {{cpp_class}}V8Internal::indexedSecurityCheck, v8::External::New(isolate, const_cast<WrapperTypeInfo*>(&{{v8_class}}::wrapperTypeInfo)));
     {% endif %}
+    {% if has_array_iterator %}
+    {% filter runtime_enabled('RuntimeEnabledFeatures::iterableCollectionsEnabled') %}
+    {% if is_global %}
+    instanceTemplate->Set(v8::Symbol::GetIterator(isolate), v8::Array::GetValuesIterator(isolate), v8::DontEnum);

[Toon Verwaest, 2015/10/14 10:59:42]

Instance templates that are supposed to be instantiated in multiple native
contexts cannot have non-primitive members. Otherwise there's a cross-context
leak between the context that the values are taken from, and the context they
are injected into. In this case the .constructor (Function) from the context
active during template creation leaks, creating a full UXSS between that context
and any context that gets global objects afterwards. (Which provides a channel
between all contexts and origins).

[caitp (gmail), 2015/10/14 12:32:03]

It sounds like the non-global interfaces could also have this problem, I'm not
sure I understand why they don't.

What would be an alternative strategy that people could live with?

+    {% else %}
+    prototypeTemplate->Set(v8::Symbol::GetIterator(isolate), v8::Array::GetValuesIterator(isolate), v8::DontEnum);
+    {% endif %}
+    {% endfilter %}{# runtime_enabled() #}
+    {% endif %}
     {% for attribute in attributes
        if attribute.runtime_enabled_function and
           not attribute.exposed_test %}