binding: Changes the association among global-proxy/global/window-instance.

third_party/WebKit/Source/bindings/core/v8/WindowProxy.cpp

 /*
  * Copyright (C) 2008, 2009, 2011 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 186 matching lines @@
   //   object is NOT observable from user JavaScript code.  All other
   //   prototype chains are observable.  Global proxy object and global object
   //   together appear to be the same single JavaScript object.  See also:
   //     https://wiki.mozilla.org/Gecko:SplitWindow
   //   global object (= window wrapper object) provides most of Window's DOM
   //   attributes and operations.  Also global variables defined by user
   //   JavaScript are placed on this object.  When navigated, a new global
   //   object is created together with a new v8::Context, but the global proxy
   //   object doesn't change.
   // [3] WindowProperties is a named properties object of Window interface.
+  //
+  // Note that the wrapper object of a DOMWindow is the global proxy object, not
+  // the global object, although both of them have the internal field which
+  // points to the DOMWindow.  Since the global proxy object remains the same
+  // while navigations, the management of the wrapper association for DOMWindow
+  // is special compared to other objects.  See DOMWindow::~DOMWindow for the
+  // need of dissociation of the wrappers from DOMWindow instance.
+  //
+  //   global proxy object <====> DOMWindow instance
+  //                               ^
+  //                               |
+  //   global object       --------+
 
   DOMWindow* window = m_frame->domWindow();
   const WrapperTypeInfo* wrapperTypeInfo = window->wrapperTypeInfo();
   v8::Local<v8::Context> context = m_scriptState->context();
 
   // The global proxy object.  Note this is not the global object.
   v8::Local<v8::Object> globalProxy = context->Global();
   CHECK(m_globalProxy == globalProxy);
-  V8DOMWrapper::setNativeInfo(m_isolate, globalProxy, wrapperTypeInfo, window);
+  v8::Local<v8::Object> associatedWrapper =
+      V8DOMWrapper::associateObjectWithWrapper(
+          m_isolate, window, wrapperTypeInfo, globalProxy);
+  CHECK(globalProxy == associatedWrapper);
   // Mark the handle to be traced by Oilpan, since the global proxy has a
   // reference to the DOMWindow.
   m_globalProxy.get().SetWrapperClassId(wrapperTypeInfo->wrapperClassId);
 
   // The global object, aka window wrapper object.
   v8::Local<v8::Object> windowWrapper =
       globalProxy->GetPrototype().As<v8::Object>();
-  windowWrapper = V8DOMWrapper::associateObjectWithWrapper(
-      m_isolate, window, wrapperTypeInfo, windowWrapper);
+  V8DOMWrapper::setNativeInfo(m_isolate, windowWrapper, wrapperTypeInfo,
+                              window);
 
   // The prototype object of Window interface.
   v8::Local<v8::Object> windowPrototype =
       windowWrapper->GetPrototype().As<v8::Object>();
   CHECK(!windowPrototype.IsEmpty());
   V8DOMWrapper::setNativeInfo(m_isolate, windowPrototype, wrapperTypeInfo,
                               window);
 
   // The named properties object of Window interface.
   v8::Local<v8::Object> windowProperties =
       windowPrototype->GetPrototype().As<v8::Object>();
   CHECK(!windowProperties.IsEmpty());
   V8DOMWrapper::setNativeInfo(m_isolate, windowProperties, wrapperTypeInfo,
                               window);
 
   // TODO(keishi): Remove installPagePopupController and implement
   // PagePopupController in another way.
   V8PagePopupControllerBinding::installPagePopupController(context,
                                                            windowWrapper);
 }
 
 }  // namespace blink