binding: Removes Document::wrap that must be equivalent to Node::wrap. (2nd try)

third_party/WebKit/Source/bindings/core/v8/WindowProxy.cpp

Index: third_party/WebKit/Source/bindings/core/v8/WindowProxy.cpp
diff --git a/third_party/WebKit/Source/bindings/core/v8/WindowProxy.cpp b/third_party/WebKit/Source/bindings/core/v8/WindowProxy.cpp
index dec4bd5fea06c5ce882790166ed7a9e404996d1c..efbfe6d47e7b3f6785f5bf9f4401bbe5be60a3ab 100644
--- a/third_party/WebKit/Source/bindings/core/v8/WindowProxy.cpp
+++ b/third_party/WebKit/Source/bindings/core/v8/WindowProxy.cpp
@@ -33,6 +33,7 @@
 #include "bindings/core/v8/ConditionalFeatures.h"
 #include "bindings/core/v8/DOMWrapperWorld.h"
 #include "bindings/core/v8/ScriptController.h"
+#include "bindings/core/v8/ToV8.h"
 #include "bindings/core/v8/V8Binding.h"
 #include "bindings/core/v8/V8DOMActivityLogger.h"
 #include "bindings/core/v8/V8Document.h"
@@ -73,11 +74,6 @@
 
 namespace blink {
 
-static void checkDocumentWrapper(v8::Local<v8::Object> wrapper,
-                                 Document* document) {
-  ASSERT(V8Document::toImpl(wrapper) == document);
-}
-
 WindowProxy* WindowProxy::create(v8::Isolate* isolate,
                                  Frame* frame,
                                  DOMWrapperWorld& world) {
@@ -424,33 +420,24 @@ bool WindowProxy::setupWindowPrototypeChain() {
   return true;
 }
 
-void WindowProxy::updateDocumentWrapper(v8::Local<v8::Object> wrapper) {
-  ASSERT(m_world->isMainWorld());
-  m_document.set(m_isolate, wrapper);
-}
-
 void WindowProxy::updateDocumentProperty() {
-  if (!m_world->isMainWorld())
-    return;
+  DCHECK(m_world->isMainWorld());
 
-  if (m_frame->isRemoteFrame()) {
+  if (m_frame->isRemoteFrame())
     return;
-  }
 
   ScriptState::Scope scope(m_scriptState.get());
   v8::Local<v8::Context> context = m_scriptState->context();
   LocalFrame* frame = toLocalFrame(m_frame);
+  // In the main world, the window.document attribute must be set right after
+  // the initialization of the Window or right after the installation of a new
+  // document, thus this must be the first time of the wrapper instantiation of
+  // the document.
+  CHECK(!frame->document()->containsWrapper());

[Yuki, 2016/12/02 09:08:06]

This CHECK and comment are wrong.  We can create a new document and instantiate
its wrapper before initializing a WindowProxy.  For example,
    <image id="foo"/>
    <script>
    iframe = document.createElement('iframe');
    document.body.appendChild(iframe);
    d = iframe.contentDocument;  // document wrapper gets instantiated
    d.appendChild(window.foo);  // initialize the iframe's WindowProxy in order
to add an named object
    </script>

   v8::Local<v8::Value> documentWrapper =
-      toV8(frame->document(), context->Global(), context->GetIsolate());
-  if (documentWrapper.IsEmpty())
-    return;
-  ASSERT(documentWrapper == m_document.newLocal(m_isolate) ||
-         m_document.isEmpty());
-  if (m_document.isEmpty())
-    updateDocumentWrapper(v8::Local<v8::Object>::Cast(documentWrapper));
-  checkDocumentWrapper(m_document.newLocal(m_isolate), frame->document());
-
-  ASSERT(documentWrapper->IsObject());
+      toV8(frame->document(), context->Global(), m_isolate);
+  DCHECK(documentWrapper->IsObject());
+  m_document.set(m_isolate, documentWrapper.As<v8::Object>());
 
   // Update cached accessor.
   CHECK(V8PrivateProperty::getWindowDocumentCachedAccessor(m_isolate).set(
@@ -518,7 +505,7 @@ void WindowProxy::setSecurityToken(SecurityOrigin* origin) {
 }
 
 void WindowProxy::updateDocument() {
-  ASSERT(m_world->isMainWorld());
+  DCHECK(m_world->isMainWorld());
   if (!isGlobalInitialized())
     return;
   if (!isContextInitialized())
@@ -575,24 +562,31 @@ static void getter(v8::Local<v8::Name> property,
     v8SetReturnValue(info, value);
 }
 
+void WindowProxy::checkDocumentWrapper(v8::Local<v8::Object> wrapper,
+                                       Document* document) const {
+  DCHECK(!wrapper.IsEmpty());
+  DCHECK_EQ(V8Document::toImpl(wrapper), document);
+  DCHECK(wrapper ==
+         toV8(document, m_globalProxy.newLocal(m_isolate), m_isolate));
+}
+
 void WindowProxy::namedItemAdded(HTMLDocument* document,
                                  const AtomicString& name) {
-  ASSERT(m_world->isMainWorld());
+  DCHECK(m_world->isMainWorld());
 
   if (!isContextInitialized() || !m_scriptState->contextIsValid())
     return;
 
   ScriptState::Scope scope(m_scriptState.get());
-  ASSERT(!m_document.isEmpty());
-  v8::Local<v8::Context> context = m_scriptState->context();
-  v8::Local<v8::Object> documentHandle = m_document.newLocal(m_isolate);
-  checkDocumentWrapper(documentHandle, document);
-  documentHandle->SetAccessor(context, v8String(m_isolate, name), getter);
+  v8::Local<v8::Object> documentWrapper = m_document.newLocal(m_isolate);
+  checkDocumentWrapper(documentWrapper, document);
+  documentWrapper->SetAccessor(m_isolate->GetCurrentContext(),
+                               v8String(m_isolate, name), getter);
 }
 
 void WindowProxy::namedItemRemoved(HTMLDocument* document,
                                    const AtomicString& name) {
-  ASSERT(m_world->isMainWorld());
+  DCHECK(m_world->isMainWorld());
 
   if (!isContextInitialized())
     return;
@@ -601,11 +595,10 @@ void WindowProxy::namedItemRemoved(HTMLDocument* document,
     return;
 
   ScriptState::Scope scope(m_scriptState.get());
-  ASSERT(!m_document.isEmpty());
-  v8::Local<v8::Object> documentHandle = m_document.newLocal(m_isolate);
-  checkDocumentWrapper(documentHandle, document);
-  documentHandle->Delete(m_isolate->GetCurrentContext(),
-                         v8String(m_isolate, name));
+  v8::Local<v8::Object> documentWrapper = m_document.newLocal(m_isolate);
+  checkDocumentWrapper(documentWrapper, document);
+  documentWrapper->Delete(m_isolate->GetCurrentContext(),
+                          v8String(m_isolate, name));
 }
 
 void WindowProxy::updateSecurityOrigin(SecurityOrigin* origin) {