Optionally invoke an interceptor on failed access checks

src/keys.cc

 // Copyright 2013 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/keys.h"
 
 #include "src/api-arguments.h"
 #include "src/elements.h"
 #include "src/factory.h"
 #include "src/identity-map.h"
@@ skipping 416 matching lines @@
 namespace {
 
 enum IndexedOrNamed { kIndexed, kNamed };
 
 // Returns |true| on success, |nothing| on exception.
 template <class Callback, IndexedOrNamed type>
 Maybe<bool> CollectInterceptorKeys(Handle<JSReceiver> receiver,
                                    Handle<JSObject> object,
                                    KeyAccumulator* accumulator) {
   Isolate* isolate = accumulator->isolate();
-  if (type == kIndexed) {
-    if (!object->HasIndexedInterceptor()) return Just(true);
+  Handle<InterceptorInfo> interceptor;
+  if ((accumulator->filter() & USE_ACCESS_CHECK_INTERCEPTOR) &&
+      object->IsAccessCheckNeeded()) {
+    DisallowHeapAllocation no_gc;
+    AccessCheckInfo* access_check_info = AccessCheckInfo::Get(isolate, object);
+    if (!access_check_info) return Just(true);
+    Object* maybe_interceptor = type == kIndexed
+                                    ? access_check_info->indexed_interceptor()
+                                    : access_check_info->named_interceptor();
+    if (!maybe_interceptor) return Just(true);
+    interceptor = handle(InterceptorInfo::cast(maybe_interceptor), isolate);
   } else {
-    if (!object->HasNamedInterceptor()) return Just(true);
-  }
-  Handle<InterceptorInfo> interceptor(type == kIndexed
-                                          ? object->GetIndexedInterceptor()
+    if (type == kIndexed) {
+      if (!object->HasIndexedInterceptor()) return Just(true);
+    } else {
+      if (!object->HasNamedInterceptor()) return Just(true);
+    }
+    interceptor = handle(type == kIndexed ? object->GetIndexedInterceptor()
                                           : object->GetNamedInterceptor(),
-                                      isolate);
-  if ((accumulator->filter() & ONLY_ALL_CAN_READ) &&
-      !interceptor->all_can_read()) {
-    return Just(true);
+                         isolate);
+    if ((accumulator->filter() & ONLY_ALL_CAN_READ) &&
+        !interceptor->all_can_read()) {
+      return Just(true);
+    }
   }
   PropertyCallbackArguments args(isolate, interceptor->data(), *receiver,
                                  *object, Object::DONT_THROW);
   Handle<JSObject> result;
   if (!interceptor->enumerator()->IsUndefined(isolate)) {
     Callback enum_fun = v8::ToCData<Callback>(interceptor->enumerator());
     const char* log_tag = type == kIndexed ? "interceptor-indexed-enum"
                                            : "interceptor-named-enum";
     LOG(isolate, ApiObjectAccess(log_tag, *object));
     result = args.Call(enum_fun);
@@ skipping 18 matching lines @@
                                 kIndexed>(receiver, object, this);
 }
 
 namespace {
 
 template <bool skip_symbols>
 int CollectOwnPropertyNamesInternal(Handle<JSObject> object,
                                     KeyAccumulator* keys,
                                     Handle<DescriptorArray> descs,
                                     int start_index, int limit) {
+  DCHECK(!(keys->filter() & USE_ACCESS_CHECK_INTERCEPTOR));
   int first_skipped = -1;
   for (int i = start_index; i < limit; i++) {
     PropertyDetails details = descs->GetDetails(i);
     if ((details.attributes() & keys->filter()) != 0) continue;
     if (keys->filter() & ONLY_ALL_CAN_READ) {
       if (details.kind() != kAccessor) continue;
       Object* accessors = descs->GetValue(i);
       if (!accessors->IsAccessorInfo()) continue;
       if (!AccessorInfo::cast(accessors)->all_can_read()) continue;
     }
     Name* key = descs->GetKey(i);
     if (skip_symbols == key->IsSymbol()) {
       if (first_skipped == -1) first_skipped = i;
       continue;
     }
     if (key->FilterKey(keys->filter())) continue;
     keys->AddKey(key, DO_NOT_CONVERT);
   }
   return first_skipped;
 }
 
 }  // namespace
 
 Maybe<bool> KeyAccumulator::CollectOwnPropertyNames(Handle<JSReceiver> receiver,
                                                     Handle<JSObject> object) {
   if (filter_ == ENUMERABLE_STRINGS) {
     Handle<FixedArray> enum_keys =
         KeyAccumulator::GetEnumPropertyKeys(isolate_, object);
     AddKeys(enum_keys, DO_NOT_CONVERT);
-  } else {
+  } else if (!(filter_ & USE_ACCESS_CHECK_INTERCEPTOR)) {
     if (object->HasFastProperties()) {
       int limit = object->map()->NumberOfOwnDescriptors();
       Handle<DescriptorArray> descs(object->map()->instance_descriptors(),
                                     isolate_);
       // First collect the strings,
       int first_symbol =
           CollectOwnPropertyNamesInternal<true>(object, this, descs, 0, limit);
       // then the symbols.
       if (first_symbol != -1) {
         CollectOwnPropertyNamesInternal<false>(object, this, descs,
@@ skipping 12 matching lines @@
                                 kNamed>(receiver, object, this);
 }
 
 // Returns |true| on success, |false| if prototype walking should be stopped,
 // |nothing| if an exception was thrown.
 Maybe<bool> KeyAccumulator::CollectOwnKeys(Handle<JSReceiver> receiver,
                                            Handle<JSObject> object) {
   // Check access rights if required.
   if (object->IsAccessCheckNeeded() &&
       !isolate_->MayAccess(handle(isolate_->context()), object)) {
+    DisallowHeapAllocation no_gc;
+
     // The cross-origin spec says that [[Enumerate]] shall return an empty
     // iterator when it doesn't have access...
     if (mode_ == KeyCollectionMode::kIncludePrototypes) {
       return Just(false);
     }
     // ...whereas [[OwnPropertyKeys]] shall return whitelisted properties.
     DCHECK(KeyCollectionMode::kOwnOnly == mode_);
-    filter_ = static_cast<PropertyFilter>(filter_ | ONLY_ALL_CAN_READ);
+    AccessCheckInfo* access_check_info = AccessCheckInfo::Get(isolate_, object);
+    // We always either have both a named and an indexed interceptor or none.
+    if (!access_check_info || !access_check_info->named_interceptor()) {
+      filter_ = static_cast<PropertyFilter>(filter_ | ONLY_ALL_CAN_READ);
+    } else {
+      filter_ =
+          static_cast<PropertyFilter>(filter_ | USE_ACCESS_CHECK_INTERCEPTOR);

[Toon Verwaest, 2016/06/27 09:34:58]

We should get rid of these filters. Just duplicate the collecting path; we're
not going to walk the prototype chain anyway.

So I'd suggest keeping the old ALL_CAN_READ filter for the old case, removing it
once we migrated everyone over. And calling into a new method that just returns
the values from the interceptor directly, rather than reusing the complex
machinery of CollectOwn*; which becomes even more complex with these flags.

Keeping things separate will make both paths faster and less convoluted.

[Toon Verwaest, 2016/06/27 09:37:59]

I think you basically want to reuse the lower half of CollectInterceptorKeys and
only that for the !MayAccess case.

+    }
   }
   MAYBE_RETURN(CollectOwnElementIndices(receiver, object), Nothing<bool>());
   MAYBE_RETURN(CollectOwnPropertyNames(receiver, object), Nothing<bool>());
   return Just(true);
 }
 
 // static
 Handle<FixedArray> KeyAccumulator::GetEnumPropertyKeys(
     Isolate* isolate, Handle<JSObject> object) {
+  DCHECK(!object->IsAccessCheckNeeded() ||
+         isolate->MayAccess(handle(isolate->context()), object));
   if (object->HasFastProperties()) {
     return GetFastEnumPropertyKeys(isolate, object);
   } else if (object->IsJSGlobalObject()) {
     Handle<GlobalDictionary> dictionary(object->global_dictionary(), isolate);
     int length = dictionary->NumberOfEnumElements();
     if (length == 0) {
       return isolate->factory()->empty_fixed_array();
     }
     Handle<FixedArray> storage = isolate->factory()->NewFixedArray(length);
     dictionary->CopyEnumKeysTo(*storage);
@@ skipping 165 matching lines @@
       isolate_, keys, JSReceiver::OwnPropertyKeys(target), Nothing<bool>());
   bool prev_filter_proxy_keys_ = filter_proxy_keys_;
   filter_proxy_keys_ = false;
   Maybe<bool> result = AddKeysFromJSProxy(proxy, keys);
   filter_proxy_keys_ = prev_filter_proxy_keys_;
   return result;
 }
 
 }  // namespace internal
 }  // namespace v8