Switch RemoteWindowProxy to use v8::Context::NewRemoteContext.

third_party/WebKit/Source/bindings/templates/methods.cpp.tmpl

 {% from 'utilities.cpp.tmpl' import declare_enum_validation_variable, v8_value_to_local_cpp_value %}
 
 {##############################################################################}
 {% macro generate_method(method, world_suffix) %}
 static void {{method.name}}{{method.overload_index}}Method{{world_suffix}}(const v8::FunctionCallbackInfo<v8::Value>& info) {
   {% filter format_remove_duplicates([
       'ExceptionState exceptionState',
       'ScriptState* scriptState = ']) %}
   {% set define_exception_state -%}
   ExceptionState exceptionState(info.GetIsolate(), ExceptionState::ExecutionContext, "{{interface_name}}", "{{method.name}}");
   {%- endset %}
 
   {% set function_call = func_call_with_prep_of_args(method, world_suffix) %}
 
   {% if 'exceptionState' in function_call or
-        (method.returns_promise and not method.is_static) %}
+        ((method.returns_promise or interface_name == 'Window' or interface_name == 'EventTarget') and not method.is_static) %}

[dcheng, 2017/02/16 10:48:36]

I had to add EventTarget to this list as well...

To make this less hardcoded in the bindings, I propose:

- adding an interface-level attribute CheckReceiver.
- add MethodCall as a mandatory argument. The reason is this is really only
needed for method invocations. The interface definition will look like

  [CheckReceiver=MethodCall]
  interface Window { ... };

- update the bindings generator to throw an error if a CheckReceiver=MethodCall
interface inherits a non CheckReceiver=MethodCall interface.

Does this sound reasonable?

[Yuki, 2017/02/16 12:47:39]

Could you help me understand the situation?  You're saying that

a) We cannot rely on v8::Signature because it doesn't work for remote global
proxy.

b) v8::FunctionTemplate::HasInstance (or its family) works for remote global
proxy, too.  (You're now making it work for remote cases.)

Are these right?

I don't know internal details of V8, but is it difficult to make v8::Signature
work for remote global proxy?  The remote global proxy is already so special. 
I'm wondering if we could make the remote global proxy look like a local global
object rather than a local global proxy.

[dcheng, 2017/02/16 19:50:23]

Correct. Due to the way we create the proxy template for a JSGlobalProxy,
Blink's DOM template for Window will never match.
Yes, this is proving to be quite hacky. That being said, I'd like to land some
version of this sooner rather than later; let me see if I can hack the
compatible receiver check so we can handle this internally in v8.

[Yuki, 2017/02/17 06:49:31]

Thanks for the explanation.  Overall, I'm okay with this.

If you think we can get rid of this hack by moving it into V8, I don't think we
need to introduce [CheckReceiver=MethodCall].  Instead, I'd like to have
comments to describe the situation and plan.

I'm also fine with introducing an extended attribute, but I'd prefer another
name that indicates/implies "hack to handle remote frames".  At least,
[CheckReceiver] is a bit confusing with [CheckSecurity=Receiver].  This work can
be a separate CL.

[dcheng, 2017/02/17 07:16:52]

I was getting pretty unhappy with how the code looked in v8, since there were
too many special cases for JSGlobalProxy. The good news is I got it working, and
cleaned up many of the manual checks in Blink. The bad news is the v8 patch has
a small hack for hidden prototypes that I don't understand:
https://codereview.chromium.org/2677653002/diff/40001/src/bootstrapper.cc

I'm working on figuring out what's going wrong, so I can remove the hack.

   {{define_exception_state}}
   {% if method.returns_promise %}
   ExceptionToRejectPromiseScope rejectPromiseScope(info, exceptionState);
   {% endif %}
   {% endif %}
 
   {% if not method.is_static %}
-  {% if method.returns_promise %}
+  {% if method.returns_promise or interface_name == 'Window' or interface_name == 'EventTarget' %}
   // V8DOMConfiguration::DoNotCheckHolder
   // Make sure that info.Holder() really points to an instance of the type.
   if (!{{v8_class}}::hasInstance(info.Holder(), info.GetIsolate())) {
     {{throw_type_error(method, '"Illegal invocation"')}}
     return;
   }
   {% endif %}
   {% set local_dom_window_only = interface_name == 'Window' and not method.is_cross_origin %}
   {% if local_dom_window_only %}
   {% if method.is_check_security_for_receiver %}
@@ skipping 505 matching lines @@
 
 {##############################################################################}
 {% macro origin_safe_method_getter(method, world_suffix) %}
 {# TODO(dcheng): Currently, bindings must create a function object for each
    realm as a hack to support the incumbent realm. Clean this up when Blink
    properly supports the incumbent realm. #}
 static void {{method.name}}OriginSafeMethodGetter{{world_suffix}}(const v8::PropertyCallbackInfo<v8::Value>& info) {
   static int domTemplateKey; // This address is used for a key to look up the dom template.
   V8PerIsolateData* data = V8PerIsolateData::from(info.GetIsolate());
   const DOMWrapperWorld& world = DOMWrapperWorld::world(info.GetIsolate()->GetCurrentContext());
+{% if interface_name == 'Window' %}
+  // Note: signature is intentionally omitted for functions that use Window as
+  // the receiver object. A remote context's global proxy does not have the
+  // standard prototype chain set up, so v8 won't be able to find the receiver
+  // type in the prototype chain. Instead, the method implementation must do
+  // the check manually.
+  v8::Local<v8::Signature> signature;
+{% else %}
   v8::Local<v8::FunctionTemplate> interfaceTemplate = data->findInterfaceTemplate(world, &{{v8_class}}::wrapperTypeInfo);
   v8::Local<v8::Signature> signature = v8::Signature::New(info.GetIsolate(), interfaceTemplate);
+{% endif %}
 
   v8::Local<v8::FunctionTemplate> methodTemplate = data->findOrCreateOperationTemplate(world, &domTemplateKey, {{v8_class_or_partial}}::{{method.name}}MethodCallback{{world_suffix}}, v8Undefined(), signature, {{method.length}});
   // Return the function by default, unless the user script has overwritten it.
   v8SetReturnValue(info, methodTemplate->GetFunction(info.GetIsolate()->GetCurrentContext()).ToLocalChecked());
 
   {{cpp_class}}* impl = {{v8_class}}::toImpl(info.Holder());
   if (!BindingSecurity::shouldAllowAccessTo(currentDOMWindow(info.GetIsolate()), impl, BindingSecurity::ErrorReportOption::DoNotReport)) {
     return;
   }
 
@@ skipping 59 matching lines @@
 {% from 'utilities.cpp.tmpl' import property_location %}
 {% set method_callback =
        '%s::%sMethodCallback' % (v8_class_or_partial, method.name) %}
 {% set method_callback_for_main_world =
        '%s::%sMethodCallbackForMainWorld' % (v8_class_or_partial, method.name)
        if method.is_per_world_bindings else 'nullptr' %}
 {% set property_attribute =
        'static_cast<v8::PropertyAttribute>(%s)' % ' | '.join(method.property_attributes)
        if method.property_attributes else 'v8::None' %}
 {% set holder_check = 'V8DOMConfiguration::DoNotCheckHolder'
-       if method.returns_promise else 'V8DOMConfiguration::CheckHolder' %}
+       if method.returns_promise or interface_name == 'Window' or interface_name == 'EventTarget' else 'V8DOMConfiguration::CheckHolder' %}
 {"{{method.name}}", {{method_callback}}, {{method_callback_for_main_world}}, {{method.length}}, {{property_attribute}}, {{property_location(method)}}, {{holder_check}}}
 {%- endmacro %}
 
 
 {######################################}
 {% macro install_custom_signature(method, instance_template, prototype_template, interface_template, signature) %}
 const V8DOMConfiguration::MethodConfiguration {{method.name}}MethodConfiguration = {{method_configuration(method)}};
 V8DOMConfiguration::installMethod(isolate, world, {{instance_template}}, {{prototype_template}}, {{interface_template}}, {{signature}}, {{method.name}}MethodConfiguration);
 {%- endmacro %}
 
@@ skipping 16 matching lines @@
                           if method.overloads else
                           method.runtime_enabled_feature_name) %}
 const V8DOMConfiguration::MethodConfiguration {{method.name}}MethodConfiguration = {{method_configuration(method)}};
 V8DOMConfiguration::installMethod(isolate, world, v8::Local<v8::Object>(), prototypeObject, interfaceObject, signature, {{method.name}}MethodConfiguration);
 {% endfilter %}{# runtime_enabled() #}
 {% endfilter %}{# exposed() #}
 {% endfilter %}{# secure_context() #}
 {% endfor %}
 {% endif %}
 {%- endmacro %}