Segv when PDF-side JS object property getter invoked from XFA.

fpdfsdk/src/javascript/JS_Runtime.cpp

 // Copyright 2014 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #include "JS_Runtime.h"
 
 #include "../../../xfa/src/fxjse/src/value.h"
 #include "../../include/fpdfxfa/fpdfxfa_app.h"
@@ skipping 227 matching lines @@
   return sRet;
 }
 FX_BOOL CJS_Runtime::GetHValueByName(const CFX_ByteStringC& utf8Name,
                                      FXJSE_HVALUE hValue) {
 #ifdef PDF_ENABLE_XFA
   const FX_CHAR* name = utf8Name.GetCStr();
 
   v8::Locker lock(GetIsolate());
   v8::Isolate::Scope isolate_scope(GetIsolate());
   v8::HandleScope handle_scope(GetIsolate());
+  v8::Local<v8::Context> old_context = GetIsolate()->GetCurrentContext();
   v8::Local<v8::Context> context =
       v8::Local<v8::Context>::New(GetIsolate(), m_context);
   v8::Context::Scope context_scope(context);
 
-  // v8::Local<v8::Context> tmpCotext =
-  // v8::Local<v8::Context>::New(GetIsolate(), m_context);
+  // Caution: We're about to hand to XFA an object that may well require
+  // |context| to obtain this CJS_Runtime, but XFA will invoke against
+  // its own |old_context|, which has no CJS_Runtime. Associate ourselves
+  // with it at this point.

[jochen (gone - plz use gerrit), 2015/11/07 05:56:18]

i don't understand this comment?

[Tom Sepez, 2015/11/09 22:15:05]

Because the new XFA code and the old PDF code don't co-operate with each other
when invoking javascript, there are two (or more?) possible v8::Contexts that
are present -- one for each.  PDFium wants to access data from the current
contex'ts embedder data slot in order to figure out which document to operate
on.  This was set up by the PDF code.  The XFA code has no such pointer, so
whenever this code is invoked on top of a XFA-side v8::context, we store the
embedder data as if it were created by pdf.

+  // TODO(tsepez): redesign PDF-side objects to not rely on context.

[jochen (gone - plz use gerrit), 2015/11/07 05:56:18]

nor this

[Tom Sepez, 2015/11/09 22:15:05]

Changed.  Better?

+  FXJS_SetRuntimeForV8Context(old_context, this);
+
   v8::Local<v8::Value> propvalue =
       context->Global()->Get(v8::String::NewFromUtf8(
           GetIsolate(), name, v8::String::kNormalString, utf8Name.GetLength()));
 
   if (propvalue.IsEmpty()) {
     FXJSE_Value_SetUndefined(hValue);
     return FALSE;
   }
   ((CFXJSE_Value*)hValue)->ForceSetValue(propvalue);
 #endif
@@ skipping 28 matching lines @@
 
 void CJS_Runtime::AddObserver(Observer* observer) {
   ASSERT(m_observers.find(observer) == m_observers.end());
   m_observers.insert(observer);
 }
 
 void CJS_Runtime::RemoveObserver(Observer* observer) {
   ASSERT(m_observers.find(observer) != m_observers.end());
   m_observers.erase(observer);
 }