Use the current context as the creation context for cross-origin objects.

third_party/WebKit/Source/bindings/core/v8/ToV8.cpp

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "bindings/core/v8/ToV8.h"
 
 #include "bindings/core/v8/WindowProxy.h"
 #include "core/events/EventTarget.h"
 #include "core/frame/DOMWindow.h"
 #include "core/frame/Frame.h"
+#include "core/frame/Location.h"
 
 namespace blink {
 
 v8::Local<v8::Value> ToV8(DOMWindow* window,
                           v8::Local<v8::Object> creationContext,
                           v8::Isolate* isolate) {
   // Notice that we explicitly ignore creationContext because the DOMWindow
   // has its own creationContext.
 
   if (UNLIKELY(!window))
     return v8::Null(isolate);
   // Initializes environment of a frame, and return the global object
   // of the frame.
   Frame* frame = window->frame();
   if (!frame)
     return v8Undefined();
 
   return frame->windowProxy(DOMWrapperWorld::current(isolate))
       ->globalIfNotDetached();
 }
 
+v8::Local<v8::Value> ToV8(Location* location,
+                          v8::Local<v8::Object> creationContext,
+                          v8::Isolate* isolate) {
+  // https://whatwg.org/C/browsers.html#crossorigingetownpropertyhelper-(-o,-p-)
+  //
+  //   If e.[[NeedsGet]] is true, then set crossOriginGet to an anonymous
+  //   built-in function, created in the current Realm Record, that performs the
+  //   same steps as the getter of the IDL attribute P on object O.
+  //
+  // Thus, the returned object should be created in the current Realm Record as
+  // well, so ignore creationContext and use the current context as the creation
+  // context.
+  //
+  // TODO(dcheng): Is it possible for v8 to just always return the current
+  // context as the creation context of a remote context's global proxy?
+
+  if (UNLIKELY(!location))
+    return v8::Null(isolate);
+
+  v8::Local<v8::Value> wrapper = DOMDataStore::getWrapper(location, isolate);
+  if (!wrapper.IsEmpty())
+    return wrapper;
+
+  wrapper = location->wrap(isolate, isolate->GetCurrentContext()->Global());
+  DCHECK(!wrapper.IsEmpty());
+  return wrapper;
+}

[dcheng, 2017/01/19 23:34:07]

Modifying ToV8 was my original approach, but it has the problem that we only
cache one wrapper per-world. This means if a cross-origin context touches this
property first, it will be created with creation context == cross-origin
context, which has surprising affects.

To get around this, I started modifying the bindings (the currently uploaded
PS). However, it requires a bunch of code duplication, and I don't really like
it.

Instead, I want to try to add an extra bool parameter called is_cross_origin,
and gate behavior based on that bool. However, this means that we need to pass
an extra parameter for attributes that are exposed cross-origin. When
is_cross_origin is true, we will use a different creation context, and cache the
wrappers differently. I am also not sure if it will affect performance too much,
but it seems like it'll be the easiest to understand... does this last approach
sound OK?

+
 v8::Local<v8::Value> ToV8(EventTarget* impl,
                           v8::Local<v8::Object> creationContext,
                           v8::Isolate* isolate) {
   if (UNLIKELY(!impl))
     return v8::Null(isolate);
 
   if (impl->interfaceName() == EventTargetNames::DOMWindow)
     return ToV8(static_cast<DOMWindow*>(impl), creationContext, isolate);
   return ToV8(static_cast<ScriptWrappable*>(impl), creationContext, isolate);
 }
 
 }  // namespace blink