Segv when PDF-side JS object property getter invoked from XFA.

fpdfsdk/src/jsapi/fxjs_v8.cpp

 // Copyright 2014 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #include "../../include/jsapi/fxjs_v8.h"
 
 #include "core/include/fxcrt/fx_basic.h"
 
@@ skipping 269 matching lines @@
     ++g_isolate_ref_count;
 
   v8::Isolate::Scope isolate_scope(pIsolate);
   v8::Locker locker(pIsolate);
   v8::HandleScope handle_scope(pIsolate);
   v8::Local<v8::Context> v8Context =
       v8::Context::New(pIsolate, NULL, GetGlobalObjectTemplate(pIsolate));
   v8::Context::Scope context_scope(v8Context);
 
   FXJS_PerIsolateData::SetUp(pIsolate);
-  v8Context->SetAlignedPointerInEmbedderData(kPerContextDataIndex, pIRuntime);
+  FXJS_SetRuntimeForV8Context(v8Context, pIRuntime);
 
   int maxID = CFXJS_ObjDefinition::MaxID(pIsolate);
   for (int i = 0; i < maxID; ++i) {
     CFXJS_ObjDefinition* pObjDef = CFXJS_ObjDefinition::ForID(pIsolate, i);
     CFX_ByteString bs = CFX_WideString(pObjDef->m_ObjName).UTF8Encode();
     v8::Local<v8::String> m_ObjName =
         v8::String::NewFromUtf8(pIsolate, bs.c_str(),
                                 v8::NewStringType::kNormal,
                                 bs.GetLength()).ToLocalChecked();
 
@@ skipping 53 matching lines @@
         pObjDef->m_pDestructor(pObj);
       FXJS_FreePrivate(pObj);
     }
     delete pObjDef;
   }
 
   pIsolate->SetData(g_embedderDataSlot, nullptr);
   delete pData;
 }
 
-IJS_Runtime* FXJS_GetRuntimeFromIsolate(v8::Isolate* pIsolate) {
-  v8::Local<v8::Context> context = pIsolate->GetCurrentContext();
+void FXJS_SetRuntimeForV8Context(v8::Local<v8::Context> v8Context,
+                                 IJS_Runtime* pIRuntime) {
+  v8Context->SetAlignedPointerInEmbedderData(kPerContextDataIndex, pIRuntime);
+}
+
+IJS_Runtime* FXJS_GetRuntimeFromV8Context(v8::Local<v8::Context> v8Context) {
   return static_cast<IJS_Runtime*>(
-      context->GetAlignedPointerFromEmbedderData(kPerContextDataIndex));
+      v8Context->GetAlignedPointerFromEmbedderData(kPerContextDataIndex));
 }
 
 int FXJS_Execute(v8::Isolate* pIsolate,
                  IJS_Context* pJSContext,
                  const wchar_t* script,
                  FXJSErr* pError) {
   v8::Isolate::Scope isolate_scope(pIsolate);
   v8::TryCatch try_catch(pIsolate);
   CFX_ByteString bsScript = CFX_WideString(script).UTF8Encode();
   v8::Local<v8::Context> context = pIsolate->GetCurrentContext();
@@ skipping 371 matching lines @@
     return v8::Local<v8::Array>();
   v8::Local<v8::Context> context = pIsolate->GetCurrentContext();
   return v8::Local<v8::Array>::Cast(pValue->ToObject(context).ToLocalChecked());
 }
 
 void FXJS_ValueCopy(v8::Local<v8::Value>& pTo, v8::Local<v8::Value> pFrom) {
   pTo = pFrom;
 }