[CachedAccessor] for window.document.

third_party/WebKit/Source/bindings/core/v8/WindowProxy.cpp

Index: third_party/WebKit/Source/bindings/core/v8/WindowProxy.cpp
diff --git a/third_party/WebKit/Source/bindings/core/v8/WindowProxy.cpp b/third_party/WebKit/Source/bindings/core/v8/WindowProxy.cpp
index 62ec932d9569b28d588425745e57d71b8d9efc1e..26c31691a50dd2b2266207627246225dab245593 100644
--- a/third_party/WebKit/Source/bindings/core/v8/WindowProxy.cpp
+++ b/third_party/WebKit/Source/bindings/core/v8/WindowProxy.cpp
@@ -42,6 +42,7 @@
 #include "bindings/core/v8/V8Initializer.h"
 #include "bindings/core/v8/V8ObjectConstructor.h"
 #include "bindings/core/v8/V8PagePopupControllerBinding.h"
+#include "bindings/core/v8/V8PrivateProperty.h"
 #include "bindings/core/v8/V8Window.h"
 #include "core/frame/LocalFrame.h"
 #include "core/frame/csp/ContentSecurityPolicy.h"
@@ -417,12 +418,10 @@ void WindowProxy::updateDocumentProperty() {
   checkDocumentWrapper(m_document.newLocal(m_isolate), frame->document());
 
   ASSERT(documentWrapper->IsObject());
-  // TODO(jochen): Don't replace the accessor with a data value. We need a way
-  // to tell v8 that the accessor's return value won't change after this point.
-  if (!v8CallBoolean(context->Global()->ForceSet(
-          context, v8AtomicString(m_isolate, "document"), documentWrapper,
-          static_cast<v8::PropertyAttribute>(v8::ReadOnly | v8::DontDelete))))
-    return;
+
+  // Update cached accessor.
+  CHECK(V8PrivateProperty::getWindowDocumentCachedAccessor(m_isolate).set(

[jochen (gone - plz use gerrit), 2016/10/20 08:44:42]

how does this work for isolated worlds? This method (updateDocumentProperty)
bails out for non-main-worlds

[vogelheim, 2016/10/20 13:27:59]

Yes.

main world:
- accessor gets created with hidden, 'cached' accessor
- value gets set here.
- the real & slow accessor still exists. any code paths that don't know about
cached accessors use the real accessor (with a speed penalty)

non-main worlds:
- the first two steps don't happen.
- all accessors use the 'true' accessor.

We could change that, if we think this penalizes non-main-worlds too much. But
that's how it works in this CL.

+      context, context->Global(), documentWrapper));
 }
 
 void WindowProxy::updateActivityLogger() {