Switch RemoteWindowProxy to use v8::Context::NewRemoteContext.

third_party/WebKit/Source/bindings/templates/methods.cpp.tmpl

Index: third_party/WebKit/Source/bindings/templates/methods.cpp.tmpl
diff --git a/third_party/WebKit/Source/bindings/templates/methods.cpp.tmpl b/third_party/WebKit/Source/bindings/templates/methods.cpp.tmpl
index a036d5839d10565c153094f907d8123dcc7e408e..f2e8fccbfef154c5ea67e5693b9e36cda148b29c 100644
--- a/third_party/WebKit/Source/bindings/templates/methods.cpp.tmpl
+++ b/third_party/WebKit/Source/bindings/templates/methods.cpp.tmpl
@@ -13,7 +13,7 @@ static void {{method.name}}{{method.overload_index}}Method{{world_suffix}}(const
   {% set function_call = func_call_with_prep_of_args(method, world_suffix) %}
 
   {% if 'exceptionState' in function_call or
-        (method.returns_promise and not method.is_static) %}
+        ((method.returns_promise or interface_name == 'Window') and not method.is_static) %}
   {{define_exception_state}}
   {% if method.returns_promise %}
   ExceptionToRejectPromiseScope rejectPromiseScope(info, exceptionState);
@@ -21,7 +21,7 @@ static void {{method.name}}{{method.overload_index}}Method{{world_suffix}}(const
   {% endif %}
 
   {% if not method.is_static %}
-  {% if method.returns_promise %}
+  {% if method.returns_promise or interface_name == 'Window' %}
   // V8DOMConfiguration::DoNotCheckHolder
   // Make sure that info.Holder() really points to an instance of the type.
   if (!{{v8_class}}::hasInstance(info.Holder(), info.GetIsolate())) {
@@ -547,8 +547,17 @@ static void {{method.name}}OriginSafeMethodGetter{{world_suffix}}(const v8::Prop
   static int domTemplateKey; // This address is used for a key to look up the dom template.
   V8PerIsolateData* data = V8PerIsolateData::from(info.GetIsolate());
   const DOMWrapperWorld& world = DOMWrapperWorld::world(info.GetIsolate()->GetCurrentContext());
+{% if interface_name == 'Window' %}
+  // Note: signature is intentionally omitted for functions that use Window as
+  // the receiver object. A remote context's global proxy does not have the
+  // standard prototype chain set up, so v8 won't be able to find the receiver
+  // type in the prototype chain. Instead, the method implementation must do
+  // the check manually.
+  v8::Local<v8::Signature> signature;

[haraken, 2017/02/16 01:11:19]

Why don't we need to have this code for OriginSafeMethodSetter?

[dcheng, 2017/02/16 03:14:07]

v8::Signature is only used when instantiating a new v8::Function. Since the
setter does not instantiate the function, it does not need this.

+{% else %}
   v8::Local<v8::FunctionTemplate> interfaceTemplate = data->findInterfaceTemplate(world, &{{v8_class}}::wrapperTypeInfo);
   v8::Local<v8::Signature> signature = v8::Signature::New(info.GetIsolate(), interfaceTemplate);
+{% endif %}
 
   v8::Local<v8::FunctionTemplate> methodTemplate = data->findOrCreateOperationTemplate(world, &domTemplateKey, {{v8_class_or_partial}}::{{method.name}}MethodCallback{{world_suffix}}, v8Undefined(), signature, {{method.length}});
   // Return the function by default, unless the user script has overwritten it.
@@ -628,7 +637,7 @@ v8SetReturnValue(info, wrapper);
        'static_cast<v8::PropertyAttribute>(%s)' % ' | '.join(method.property_attributes)
        if method.property_attributes else 'v8::None' %}
 {% set holder_check = 'V8DOMConfiguration::DoNotCheckHolder'
-       if method.returns_promise else 'V8DOMConfiguration::CheckHolder' %}
+       if method.returns_promise or interface_name == 'Window' else 'V8DOMConfiguration::CheckHolder' %}

[haraken, 2017/02/16 01:11:19]

I don't see any change in this CL to add a type check to attributes/methods of
Window. Would you help me understand how the type check is handled?

(In essence, I guess you want to add something like [LeinientThis] to Window...)

[dcheng, 2017/02/16 03:14:07]

We only need to relax the receiver check for functions that use the WindowProxy
as a receiver object.

When just getting an attribute or method, v8 will use the cross-origin
interceptors: this works fine, because it doesn't need any receiver check.
However, when calling a v8::Function, then we must relax the receiver check.

The reason is this: when we instantiate a global proxy, the object template that
we use is *not* the object template that we passed in: v8 constructs a fresh
object template for the global proxy:
https://cs.chromium.org/chromium/src/v8/src/api.cc?rcl=c1a71b70f87cdd76fadea3....
Normally, this is not a problem, because the global object (which *is*
constructed with our object template) is also in the prototype chain, so the
receiver check works.

However, for a remote context, there is no inner global, so we can't rely on
walking up the prototype chain. I'm actually not sure how V8Window::hasInstance
gets around this, but it seems to work somehow...

(I'm going to add this into my comment in WindowProxy)

 {"{{method.name}}", {{method_callback}}, {{method_callback_for_main_world}}, {{method.length}}, {{property_attribute}}, {{property_location(method)}}, {{holder_check}}}
 {%- endmacro %}