Transitively keep track of an isolated world's children scripts and worlds.

third_party/WebKit/Source/bindings/core/v8/V8AbstractEventListener.cpp

 /*
  * Copyright (C) 2006, 2007, 2008, 2009 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 28 matching lines @@
 #include "core/events/Event.h"
 #include "core/inspector/InstanceCounters.h"
 #include "core/workers/WorkerGlobalScope.h"
 
 namespace blink {
 
 V8AbstractEventListener::V8AbstractEventListener(bool isAttribute, DOMWrapperWorld& world, v8::Isolate* isolate)
     : EventListener(JSEventListenerType)
     , m_isAttribute(isAttribute)
     , m_world(world)
+    , m_originWorld(PassRefPtr<DOMWrapperWorld>(world.originWorld()))

[haraken, 2016/01/21 10:16:15]

PassRefPtr<DOMWrapperWorld>() wouldn't be needed.

[proberge, 2016/01/29 18:00:48]

V8AbstractEventListener shouldn't have a RefPtr<DOMWrapperWorld> m_originWorld?
Don't we want to keep the reference so it doesn't get deleted?

     , m_isolate(isolate)
     , m_workerGlobalScope(nullptr)
 {
     if (isMainThread())
         InstanceCounters::incrementCounter(InstanceCounters::JSEventListenerCounter);
     else
         m_workerGlobalScope = toWorkerGlobalScope(currentExecutionContext(isolate));
 }
 
 V8AbstractEventListener::~V8AbstractEventListener()
@@ skipping 25 matching lines @@
     handleEvent(scriptState, event);
 }
 
 void V8AbstractEventListener::handleEvent(ScriptState* scriptState, Event* event)
 {
     // The callback function on XMLHttpRequest can clear the event listener and destroys 'this' object. Keep a local reference to it.
     // See issue 889829.
     RefPtrWillBeRawPtr<V8AbstractEventListener> protect(this);
 
     ScriptState::Scope scope(scriptState);
+    // Ensure the origin world gets propagated to the event and is reset afterwards.
+    DOMWrapperWorld::OriginWorldPusher worldPusher(scriptState->world(), m_originWorld);
 
     // Get the V8 wrapper for the event object.
     v8::Local<v8::Value> jsEvent = toV8(event, scriptState->context()->Global(), isolate());
     if (jsEvent.IsEmpty())
         return;
+
     invokeEventHandler(scriptState, event, v8::Local<v8::Value>::New(isolate(), jsEvent));
 }
 
 void V8AbstractEventListener::setListenerObject(v8::Local<v8::Object> listener)
 {
     ASSERT(m_listener.isEmpty());
     // Balanced in secondWeakCallback xor clearListenerObject.
     if (m_workerGlobalScope) {
         m_workerGlobalScope->registerEventListener(this);
     } else {
@@ skipping 119 matching lines @@
 
 DEFINE_TRACE(V8AbstractEventListener)
 {
 #if ENABLE(OILPAN)
     visitor->trace(m_workerGlobalScope);
 #endif
     EventListener::trace(visitor);
 }
 
 } // namespace blink