Use the current context as the creation context for cross-origin objects.

third_party/WebKit/Source/core/frame/Location.cpp

Index: third_party/WebKit/Source/core/frame/Location.cpp
diff --git a/third_party/WebKit/Source/core/frame/Location.cpp b/third_party/WebKit/Source/core/frame/Location.cpp
index 9a1ebf41694440f2ae194ad213f68852924d19bb..f3eec9124f58cca98e7c0255e7f66c22a39ccfcc 100644
--- a/third_party/WebKit/Source/core/frame/Location.cpp
+++ b/third_party/WebKit/Source/core/frame/Location.cpp
@@ -31,6 +31,7 @@
 #include "bindings/core/v8/BindingSecurity.h"
 #include "bindings/core/v8/ExceptionState.h"
 #include "bindings/core/v8/V8DOMActivityLogger.h"
+#include "bindings/core/v8/V8DOMWrapper.h"
 #include "core/dom/DOMURLUtilsReadOnly.h"
 #include "core/dom/Document.h"
 #include "core/dom/ExceptionCode.h"
@@ -119,6 +120,21 @@ DOMStringList* Location::ancestorOrigins() const {
   return origins;
 }
 
+v8::Local<v8::Object> Location::crossOriginWrapper(v8::Isolate* isolate) {

[Yuki, 2017/01/24 10:31:05]

I guess it's better to rename this function to remoteFrameWrapper?

+  if (m_crossOriginWrapper.IsEmpty()) {
+    m_crossOriginWrapper.Reset(
+        isolate, wrapperTypeInfo()
+                     ->domTemplate(isolate, DOMWrapperWorld::world(

[dcheng, 2017/01/24 09:40:47]

However, this makes me nervous. Is there a way to get a dom template that's not
associated with a world?

[Yuki, 2017/01/24 10:31:04]

No, because we have main-world-specific optimization in v8::FunctionTempalte and
its prototype template.  And this seems incorrect that we're going to use the
same v8::Object between the main world and isolated worlds.  We're going to
assume "it's in the main world" even if it's in an isolated world.

Do we really need to re-use the existing Location::wrapperTypeInfo() here?  Is
it okay to define a new WrapperTypeInfo dedicated for remote frames?

[dcheng, 2017/01/24 10:41:59]

Can you point me at the main world optimizations? I'm curious to see if it will
affect the correctness of doing this. I saw several in things like DOMDataStore,
but I want to make sure I'm looking at the right ones.

[Yuki, 2017/01/24 10:53:00]

I meant [PerWorldBindings] extended attribute, but Location.idl seems not having
it.  So probably it actually works.  But it's unfortunate to ignore worlds.

If you support things in handlers, I guess you wouldn't need much contents in
v8::FunctionTemplate?

If this approach works fine, I'm not insisting to
v8::FunctionTemplate::GetFunction.

+                                                isolate->GetCurrentContext()))
+                     ->NewRemoteInstance()

[dcheng, 2017/01/24 09:40:47]

+jochen

Sharing a remote instance like this should be safe, right? The access checks
should prevent access to anything 'interesting'. The main thing I'm worried
about is things in the prototype chain leaking between worlds / contexts, but I
think NewRemoteInstance() should be designed with that in mind, since it doesn't
use the current context?

[Yuki, 2017/01/24 10:31:04]

If it's okay, then I'd like to have a comment here to say that it's okay to
share the same v8::Object among contexts of remote frames.

+                     .ToLocalChecked());
+    V8DOMWrapper::setNativeInfo(isolate, m_crossOriginWrapper.Get(isolate),
+                                wrapperTypeInfo(), this);
+    m_crossOriginWrapper.SetWrapperClassId(wrapperTypeInfo()->wrapperClassId);
+  }
+  return m_crossOriginWrapper.Get(isolate);
+}
+
 String Location::hash() const {
   if (!m_frame)
     return String();