Ensure that privates are private.

extensions/renderer/resources/utils.js

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-var createClassWrapper = requireNative('utils').createClassWrapper;
 var nativeDeepCopy = requireNative('utils').deepCopy;
 var schemaRegistry = requireNative('schema_registry');
 var CHECK = requireNative('logging').CHECK;
 var DCHECK = requireNative('logging').DCHECK;
 var WARNING = requireNative('logging').WARNING;
 
 /**
  * An object forEach. Calls |f| with each (key, value) pair of |obj|, using
  * |self| as the target.
  * @param {Object} obj The object to iterate over.
@@ skipping 42 matching lines @@
     var types = schemaRegistry.GetSchema(schemaName).types;
   }
   for (var i = 0; i < types.length; ++i) {
     if (types[i].id == typeName)
       return types[i];
   }
   return null;
 }
 
 /**
- * Takes a private class implementation |cls| and exposes a subset of its
- * methods |functions| and properties |properties| and |readonly| in a public
- * wrapper class that it returns. Within bindings code, you can access the
- * implementation from an instance of the wrapper class using
+ * Takes a private class implementation |privateClass| and exposes a subset of
+ * its methods |functions| and properties |properties| and |readonly| to a
+ * public wrapper class that should be passed in. Within bindings code, you can
+ * access the implementation from an instance of the wrapper class using
  * privates(instance).impl, and from the implementation class you can access
  * the wrapper using this.wrapper (or implInstance.wrapper if you have another
  * instance of the implementation class).
- * @param {string} name The name of the exposed wrapper class.
- * @param {Object} cls The class implementation.
+ *
+ * |publicClass| should be a constructor that calls constructPrivate() like so:
+ *
+ *    privates(publicClass).constructPrivate(this, arguments);
+ *
+ * @param {function} publicClass The publicly exposed wrapper class. This must
+ *   be a named function, and the name appears in stack traces.

[Devlin, 2016/04/22 18:52:46]

nit: I think this should be +4 indentation from the previous line.

[robwu, 2016/04/22 20:33:43]

Done.

+ * @param {Object} privateClass The class implementation.
  * @param {{superclass: ?Function,
  *          functions: ?Array<string>,
  *          properties: ?Array<string>,
  *          readonly: ?Array<string>}} exposed The names of properties on the
  *     implementation class to be exposed. |superclass| represents the
  *     constructor of the class to be used as the superclass of the exposed
  *     class; |functions| represents the names of functions which should be
  *     delegated to the implementation; |properties| are gettable/settable
  *     properties and |readonly| are read-only properties.
  */
-function expose(name, cls, exposed) {
-  var publicClass = createClassWrapper(name, cls, exposed.superclass);
+function expose(publicClass, privateClass, exposed) {
+  DCHECK(!(privateClass instanceof $Object.self));
+
+  $Object.setPrototypeOf(exposed, null);
+
+  // This should be called by publicClass.
+  privates(publicClass).constructPrivate = function(self, args) {
+    if (!(self instanceof publicClass)) {
+      throw new Error('Please use "new ' + publicClass.name + '"');
+    }
+    // The "instanceof publicClass" check can easily be spoofed, so we check
+    // whether the private impl is already set before continuing.
+    var privateSelf = privates(self);
+    if ('impl' in privateSelf) {
+      throw new Error('Object ' + publicClass.name + ' is already constructed');
+    }
+    var privateObj = $Object.create(privateClass.prototype);
+    $Function.apply(privateClass, privateObj, args);
+    privateObj.wrapper = self;
+    privateSelf.impl = privateObj;
+  };
+
+  function getPrivateImpl(self) {
+    var impl = privates(self).impl;
+    if (!(impl instanceof privateClass)) {
+      // Either the object is not constructed, or the property descriptor is
+      // used on a target that is not an instance of publicClass.
+      throw new Error('impl is not an instance of ' + privateClass.name);
+    }
+    return impl;
+  }
+
+  var publicClassPrototype = {
+    // The final prototype will be assigned at the end of this method.
+    __proto__: null,
+  };
 
   if ('functions' in exposed) {
     $Array.forEach(exposed.functions, function(func) {
-      publicClass.prototype[func] = function() {
-        var impl = privates(this).impl;
+      publicClassPrototype[func] = function() {
+        var impl = getPrivateImpl(this);
         return $Function.apply(impl[func], impl, arguments);
       };
     });
   }
 
   if ('properties' in exposed) {
     $Array.forEach(exposed.properties, function(prop) {
-      $Object.defineProperty(publicClass.prototype, prop, {
+      $Object.defineProperty(publicClassPrototype, prop, {
+        __proto__: null,
         enumerable: true,
         get: function() {
-          return privates(this).impl[prop];
+          return getPrivateImpl(this)[prop];
         },
         set: function(value) {
-          var impl = privates(this).impl;
+          var impl = getPrivateImpl(this);
           delete impl[prop];
           impl[prop] = value;
         }
       });
     });
   }
 
   if ('readonly' in exposed) {
     $Array.forEach(exposed.readonly, function(readonly) {
-      $Object.defineProperty(publicClass.prototype, readonly, {
+      $Object.defineProperty(publicClassPrototype, readonly, {
+        __proto__: null,
         enumerable: true,
         get: function() {
-          return privates(this).impl[readonly];
+          return getPrivateImpl(this)[readonly];
         },
       });
     });
   }
 
+  // The prototype properties have been installed. Now we can safely assign an
+  // unsafe prototype and export the class to the public.
+  publicClassPrototype.__proto__ = exposed.superclass.prototype || $Object.self;

[Devlin, 2016/04/22 18:52:46]

Won't this throw if exposed.superclass is undefined?

[robwu, 2016/04/22 20:33:43]

Fixed. And I should also have used $Object.self.prototype instead of
$Object.self.

+  publicClass.prototype = publicClassPrototype;
+
   return publicClass;
 }
 
 /**
  * Returns a deep copy of |value|. The copy will have no references to nested
  * values of |value|.
  */
 function deepCopy(value) {
   return nativeDeepCopy(value);
 }
@@ skipping 29 matching lines @@
     $Function.apply(func, null, args);
   });
 }
 
 exports.$set('forEach', forEach);
 exports.$set('loadTypeSchema', loadTypeSchema);
 exports.$set('lookup', lookup);
 exports.$set('expose', expose);
 exports.$set('deepCopy', deepCopy);
 exports.$set('promise', promise);