Switch RemoteWindowProxy to use v8::Context::NewRemoteContext.

third_party/WebKit/Source/bindings/templates/methods.cpp.tmpl

 {% from 'utilities.cpp.tmpl' import declare_enum_validation_variable, v8_value_to_local_cpp_value %}
 
 {##############################################################################}
 {% macro generate_method(method, world_suffix) %}
 static void {{method.name}}{{method.overload_index}}Method{{world_suffix}}(const v8::FunctionCallbackInfo<v8::Value>& info) {
   {% filter format_remove_duplicates([
       'ExceptionState exceptionState',
       'ScriptState* scriptState = ']) %}
   {% set define_exception_state -%}
   ExceptionState exceptionState(info.GetIsolate(), ExceptionState::ExecutionContext, "{{interface_name}}", "{{method.name}}");
   {%- endset %}
 
   {% set function_call = func_call_with_prep_of_args(method, world_suffix) %}
 
   {% if 'exceptionState' in function_call or
-        (method.returns_promise and not method.is_static) %}
+        ((method.returns_promise or interface_name == 'Window') and not method.is_static) %}
   {{define_exception_state}}
   {% if method.returns_promise %}
   ExceptionToRejectPromiseScope rejectPromiseScope(info, exceptionState);
   {% endif %}
   {% endif %}
 
   {% if not method.is_static %}
-  {% if method.returns_promise %}
+  {% if method.returns_promise or interface_name == 'Window' %}
   // V8DOMConfiguration::DoNotCheckHolder
   // Make sure that info.Holder() really points to an instance of the type.
   if (!{{v8_class}}::hasInstance(info.Holder(), info.GetIsolate())) {
     {{throw_type_error(method, '"Illegal invocation"')}}
     return;
   }
   {% endif %}
   {% set local_dom_window_only = interface_name == 'Window' and not method.is_cross_origin %}
   {% if local_dom_window_only %}
   {% if method.is_check_security_for_receiver %}
@@ skipping 505 matching lines @@
 
 {##############################################################################}
 {% macro origin_safe_method_getter(method, world_suffix) %}
 {# TODO(dcheng): Currently, bindings must create a function object for each
    realm as a hack to support the incumbent realm. Clean this up when Blink
    properly supports the incumbent realm. #}
 static void {{method.name}}OriginSafeMethodGetter{{world_suffix}}(const v8::PropertyCallbackInfo<v8::Value>& info) {
   static int domTemplateKey; // This address is used for a key to look up the dom template.
   V8PerIsolateData* data = V8PerIsolateData::from(info.GetIsolate());
   const DOMWrapperWorld& world = DOMWrapperWorld::world(info.GetIsolate()->GetCurrentContext());
+{% if interface_name == 'Window' %}
+  // Note: signature is intentionally omitted for functions that use Window as
+  // the receiver object. A remote context's global proxy does not have the
+  // standard prototype chain set up, so v8 won't be able to find the receiver
+  // type in the prototype chain. Instead, the method implementation must do
+  // the check manually.
+  v8::Local<v8::Signature> signature;

[haraken, 2017/02/16 01:11:19]

Why don't we need to have this code for OriginSafeMethodSetter?

[dcheng, 2017/02/16 03:14:07]

v8::Signature is only used when instantiating a new v8::Function. Since the
setter does not instantiate the function, it does not need this.

+{% else %}
   v8::Local<v8::FunctionTemplate> interfaceTemplate = data->findInterfaceTemplate(world, &{{v8_class}}::wrapperTypeInfo);
   v8::Local<v8::Signature> signature = v8::Signature::New(info.GetIsolate(), interfaceTemplate);
+{% endif %}
 
   v8::Local<v8::FunctionTemplate> methodTemplate = data->findOrCreateOperationTemplate(world, &domTemplateKey, {{v8_class_or_partial}}::{{method.name}}MethodCallback{{world_suffix}}, v8Undefined(), signature, {{method.length}});
   // Return the function by default, unless the user script has overwritten it.
   v8SetReturnValue(info, methodTemplate->GetFunction(info.GetIsolate()->GetCurrentContext()).ToLocalChecked());
 
   {{cpp_class}}* impl = {{v8_class}}::toImpl(info.Holder());
   if (!BindingSecurity::shouldAllowAccessTo(currentDOMWindow(info.GetIsolate()), impl, BindingSecurity::ErrorReportOption::DoNotReport)) {
     return;
   }
 
@@ skipping 59 matching lines @@
 {% from 'utilities.cpp.tmpl' import property_location %}
 {% set method_callback =
        '%s::%sMethodCallback' % (v8_class_or_partial, method.name) %}
 {% set method_callback_for_main_world =
        '%s::%sMethodCallbackForMainWorld' % (v8_class_or_partial, method.name)
        if method.is_per_world_bindings else 'nullptr' %}
 {% set property_attribute =
        'static_cast<v8::PropertyAttribute>(%s)' % ' | '.join(method.property_attributes)
        if method.property_attributes else 'v8::None' %}
 {% set holder_check = 'V8DOMConfiguration::DoNotCheckHolder'
-       if method.returns_promise else 'V8DOMConfiguration::CheckHolder' %}
+       if method.returns_promise or interface_name == 'Window' else 'V8DOMConfiguration::CheckHolder' %}

[haraken, 2017/02/16 01:11:19]

I don't see any change in this CL to add a type check to attributes/methods of
Window. Would you help me understand how the type check is handled?

(In essence, I guess you want to add something like [LeinientThis] to Window...)

[dcheng, 2017/02/16 03:14:07]

We only need to relax the receiver check for functions that use the WindowProxy
as a receiver object.

When just getting an attribute or method, v8 will use the cross-origin
interceptors: this works fine, because it doesn't need any receiver check.
However, when calling a v8::Function, then we must relax the receiver check.

The reason is this: when we instantiate a global proxy, the object template that
we use is *not* the object template that we passed in: v8 constructs a fresh
object template for the global proxy:
https://cs.chromium.org/chromium/src/v8/src/api.cc?rcl=c1a71b70f87cdd76fadea3....
Normally, this is not a problem, because the global object (which *is*
constructed with our object template) is also in the prototype chain, so the
receiver check works.

However, for a remote context, there is no inner global, so we can't rely on
walking up the prototype chain. I'm actually not sure how V8Window::hasInstance
gets around this, but it seems to work somehow...

(I'm going to add this into my comment in WindowProxy)

 {"{{method.name}}", {{method_callback}}, {{method_callback_for_main_world}}, {{method.length}}, {{property_attribute}}, {{property_location(method)}}, {{holder_check}}}
 {%- endmacro %}
 
 
 {######################################}
 {% macro install_custom_signature(method, instance_template, prototype_template, interface_template, signature) %}
 const V8DOMConfiguration::MethodConfiguration {{method.name}}MethodConfiguration = {{method_configuration(method)}};
 V8DOMConfiguration::installMethod(isolate, world, {{instance_template}}, {{prototype_template}}, {{interface_template}}, {{signature}}, {{method.name}}MethodConfiguration);
 {%- endmacro %}
 
@@ skipping 16 matching lines @@
                           if method.overloads else
                           method.runtime_enabled_feature_name) %}
 const V8DOMConfiguration::MethodConfiguration {{method.name}}MethodConfiguration = {{method_configuration(method)}};
 V8DOMConfiguration::installMethod(isolate, world, v8::Local<v8::Object>(), prototypeObject, interfaceObject, signature, {{method.name}}MethodConfiguration);
 {% endfilter %}{# runtime_enabled() #}
 {% endfilter %}{# exposed() #}
 {% endfilter %}{# secure_context() #}
 {% endfor %}
 {% endif %}
 {%- endmacro %}