binding: Disallows to run a function if its context is detached.

third_party/WebKit/Source/bindings/core/v8/ScheduledAction.cpp

 /*
  * Copyright (C) 2007-2009 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 87 matching lines @@
 
 ScheduledAction::ScheduledAction(ScriptState* scriptState, const String& code)
     : m_scriptState(scriptState)
     , m_info(scriptState->isolate())
     , m_code(code, KURL())
 {
 }
 
 void ScheduledAction::execute(LocalFrame* frame)
 {
     if (!m_scriptState->contextIsValid()) {

[haraken, 2016/07/27 15:28:43]

I was thinking that this check was doing what you want to do with this CL.

Maybe the real problem is that we're using a wrong ScriptState here?

[Yuki, 2016/07/28 06:12:35]

No, m_scriptState is different from function's context.

Let's consider the following case.
    winA.setTimeout.call(winB, winC.callback, 0);

Before https://crrev.com/2049493005
    m_scriptState->context() = winA's context
    m_function.CreationContext() = winC's context
    // If winA == winC, then we don't need to check
m_function.CreationContext().

After https://crrev.com/2049493005
    m_scriptState->context() = winB's context
    m_function.CreationContext() = winC's context
    // Even if winA == winC, we need to explicitly check
m_function.CreationContext().

The problem has been that we haven't checked the ScriptState for winC.  For the
time being (i.e. while we don't support detached windows), we need to check BOTH
of winB and winC's ScriptState.

I think we didn't hit this problem just because winA == winC for most cases. 
However, we changed to use winB's context to schedule the tasks.  Then, checking
m_scriptState doesn't help about m_function.CreationContext().

         DVLOG(1) << "ScheduledAction::execute " << this << ": context is empty";
         return;
     }
 
     TRACE_EVENT0("v8", "ScheduledAction::execute");
     ScriptState::Scope scope(m_scriptState.get());
     if (!m_function.isEmpty()) {
         DVLOG(1) << "ScheduledAction::execute " << this << ": have function";
+        v8::Local<v8::Function> function = m_function.newLocal(m_scriptState->isolate());
+        ScriptState* scriptStateForFunc = ScriptState::from(function->CreationContext());
+        if (!scriptStateForFunc->contextIsValid()) {
+            DVLOG(1) << "ScheduledAction::execute " << this << ": function's context is empty";
+            return;
+        }
         Vector<v8::Local<v8::Value>> info;
         createLocalHandlesForArgs(&info);
-        V8ScriptRunner::callFunction(m_function.newLocal(m_scriptState->isolate()), frame->document(), m_scriptState->context()->Global(), info.size(), info.data(), m_scriptState->isolate());
+        V8ScriptRunner::callFunction(function, frame->document(), m_scriptState->context()->Global(), info.size(), info.data(), m_scriptState->isolate());
     } else {
         DVLOG(1) << "ScheduledAction::execute " << this << ": executing from source";
         frame->script().executeScriptAndReturnValue(m_scriptState->context(), ScriptSourceCode(m_code));
     }
 
     // The frame might be invalid at this point because JavaScript could have released it.
 }
 
 void ScheduledAction::execute(WorkerGlobalScope* worker)
 {
     ASSERT(worker->thread()->isCurrentThread());
-    ASSERT(m_scriptState->contextIsValid());
+
+    if (!m_scriptState->contextIsValid()) {
+        DVLOG(1) << "ScheduledAction::execute " << this << ": context is empty";
+        return;
+    }
+
     if (!m_function.isEmpty()) {
         ScriptState::Scope scope(m_scriptState.get());
+        v8::Local<v8::Function> function = m_function.newLocal(m_scriptState->isolate());
+        ScriptState* scriptStateForFunc = ScriptState::from(function->CreationContext());
+        if (!scriptStateForFunc->contextIsValid()) {
+            DVLOG(1) << "ScheduledAction::execute " << this << ": function's context is empty";
+            return;
+        }
         Vector<v8::Local<v8::Value>> info;
         createLocalHandlesForArgs(&info);
-        V8ScriptRunner::callFunction(m_function.newLocal(m_scriptState->isolate()), worker, m_scriptState->context()->Global(), info.size(), info.data(), m_scriptState->isolate());
+        V8ScriptRunner::callFunction(function, worker, m_scriptState->context()->Global(), info.size(), info.data(), m_scriptState->isolate());
     } else {
         worker->scriptController()->evaluate(m_code);
     }
 }
 
 void ScheduledAction::createLocalHandlesForArgs(Vector<v8::Local<v8::Value>>* handles)
 {
     handles->reserveCapacity(m_info.Size());
     for (size_t i = 0; i < m_info.Size(); ++i)
         handles->append(m_info.Get(i));
 }
 
 } // namespace blink