Avoid leaking objects between isolated worlds via attribute event listeners

Source/bindings/scripts/CodeGeneratorV8.pm

Index: Source/bindings/scripts/CodeGeneratorV8.pm
diff --git a/Source/bindings/scripts/CodeGeneratorV8.pm b/Source/bindings/scripts/CodeGeneratorV8.pm
index 084fa6806374aba9c8e059b823d6de8779d4bfa3..e02fef6687a6e0e97a123d428af295a35068358a 100644
--- a/Source/bindings/scripts/CodeGeneratorV8.pm
+++ b/Source/bindings/scripts/CodeGeneratorV8.pm
@@ -1596,6 +1596,13 @@ END
     v8SetReturnValue(info, value);
     return;
 END
+    } elsif ($attribute->signature->type eq "EventListener") {
+        AddToImplIncludes("bindings/v8/V8AbstractEventListener.h");
+        my $getterFunc = ToMethodName($attribute->signature->name);
+        # FIXME: Pass the main world ID for main-world-only getters.
+        $code .= "    EventListener* listener = imp->${getterFunc}(worldForIsolate(info.GetIsolate()));\n";
+        $code .= "    v8SetReturnValue(info, listener ? v8::Handle<v8::Value>(V8AbstractEventListener::cast(listener)->getListenerObject(imp->scriptExecutionContext())) : v8::Handle<v8::Value>(v8Null(info.GetIsolate())));\n";
+        $code .= "    return;\n";
     } else {
         my $nativeValue = NativeToJSValue($attribute->signature->type, $attribute->signature->extendedAttributes, $expression, "    ", "", "info.Holder()", "info.GetIsolate()", "info", "imp", "ReturnUnsafeHandle", $forMainWorldSuffix, "return");
         $code .= "${nativeValue}\n";
@@ -1881,17 +1888,15 @@ END
             AddToImplIncludes("bindings/v8/V8AbstractEventListener.h");
             if (!InheritsInterface($interface, "Node")) {
                 my $attrImplName = GetImplName($attribute->signature);
-                $code .= "    transferHiddenDependency(info.Holder(), imp->${attrImplName}(), value, ${v8ClassName}::eventListenerCacheIndex, info.GetIsolate());\n";
+                $code .= "    transferHiddenDependency(info.Holder(), imp->${attrImplName}(worldForIsolate(info.GetIsolate())), value, ${v8ClassName}::eventListenerCacheIndex, info.GetIsolate());\n";
             }
             AddToImplIncludes("bindings/v8/V8EventListenerList.h");
             if (($interfaceName eq "DOMWindow" or $interfaceName eq "WorkerContext") and $attribute->signature->name eq "onerror") {
                 AddToImplIncludes("bindings/v8/V8ErrorHandler.h");
-                $code .= "    imp->set$implSetterFunctionName(V8EventListenerList::findOrCreateWrapper<V8ErrorHandler>(value, true)";
+                $code .= "    imp->set$implSetterFunctionName(V8EventListenerList::findOrCreateWrapper<V8ErrorHandler>(value, true), worldForIsolate(info.GetIsolate()));\n";
             } else {
-                $code .= "    imp->set$implSetterFunctionName(V8EventListenerList::getEventListener(value, true, ListenerFindOrCreate)";
+                $code .= "    imp->set$implSetterFunctionName(V8EventListenerList::getEventListener(value, true, ListenerFindOrCreate), worldForIsolate(info.GetIsolate()));\n";
             }
-            $code .= ", ec" if $useExceptions;
-            $code .= ");\n";
         } else {
             my ($functionName, @arguments) = SetterExpression($interfaceName, $attribute);
             push(@arguments, $expression);
@@ -5236,13 +5241,6 @@ sub NativeToJSValue
       return "$indent$receiver toV8($nativeValue, $getCreationContext, $getIsolate);";
     }
 
-    if ($type eq "EventListener") {
-        AddToImplIncludes("bindings/v8/V8AbstractEventListener.h");
-        my $returnValue = "$nativeValue ? v8::Handle<v8::Value>(static_cast<V8AbstractEventListener*>(${nativeValue})->getListenerObject(imp->scriptExecutionContext())) : v8::Handle<v8::Value>(v8Null($getIsolate))";
-        return "${indent}v8SetReturnValue(${getHolderContainer}, $returnValue);" if $isReturnValue;
-        return "$indent$receiver $returnValue;";
-    }
-
     if ($type eq "SerializedScriptValue") {
         AddToImplIncludes("$type.h");
         my $returnValue = "$nativeValue ? $nativeValue->deserialize() : v8::Handle<v8::Value>(v8Null($getIsolate))";