Index: third_party/WebKit/Source/core/html/HTMLTableElement.cpp |
diff --git a/third_party/WebKit/Source/core/html/HTMLTableElement.cpp b/third_party/WebKit/Source/core/html/HTMLTableElement.cpp |
index 6d507ba3f0712a285d36db17bfa20c961dd39415..33162549edbe422699d15c50139458fc469bc8cc 100644 |
--- a/third_party/WebKit/Source/core/html/HTMLTableElement.cpp |
+++ b/third_party/WebKit/Source/core/html/HTMLTableElement.cpp |
@@ -453,8 +453,20 @@ HTMLTableElement::additionalPresentationAttributeStyle() { |
// Setting the border to 'hidden' allows it to win over any border |
// set on the table's cells during border-conflict resolution. |
if (m_rulesAttr != UnsetRules) { |
+ // Note: this (Mutable)StylePropertySet singleton has an embedded |
+ // CSSStyleDeclaration reference (m_cssomWrapper), which is a |
+ // ScriptWrappable (=> it can have a v8 wrapper object). Exposing |
+ // and sharing those via static locals is unsafe, as the singleton |
+ // really is accessible across window contexts within a renderer |
+ // process. |
+ // |
+ // However, that CSSStyleDeclaration is never instantiated for these |
+ // presentation attribute style properties, hence this singleton (and |
+ // the ones below) are considered safe. Indicate that by disabling |
+ // the no-ScriptWrappables-in-singletons verification check. |
haraken
2017/02/11 10:25:20
Your analysis looks correct, but it looks better t
sof
2017/02/11 12:09:11
That could probably be done without it being too a
|
DEFINE_STATIC_LOCAL(StylePropertySet, solidBorderStyle, |
- (createBorderStyle(CSSValueHidden))); |
+ (createBorderStyle(CSSValueHidden)), |
+ CheckScriptWrappable::No); |
return &solidBorderStyle; |
} |
return nullptr; |
@@ -462,11 +474,13 @@ HTMLTableElement::additionalPresentationAttributeStyle() { |
if (m_borderColorAttr) { |
DEFINE_STATIC_LOCAL(StylePropertySet, solidBorderStyle, |
- (createBorderStyle(CSSValueSolid))); |
+ (createBorderStyle(CSSValueSolid)), |
+ CheckScriptWrappable::No); |
return &solidBorderStyle; |
} |
DEFINE_STATIC_LOCAL(StylePropertySet, outsetBorderStyle, |
- (createBorderStyle(CSSValueOutset))); |
+ (createBorderStyle(CSSValueOutset)), |
+ CheckScriptWrappable::No); |
return &outsetBorderStyle; |
} |
@@ -570,11 +584,13 @@ const StylePropertySet* HTMLTableElement::additionalGroupStyle(bool rows) { |
if (rows) { |
DEFINE_STATIC_LOCAL(StylePropertySet, rowBorderStyle, |
- (createGroupBorderStyle(true))); |
+ (createGroupBorderStyle(true)), |
+ CheckScriptWrappable::No); |
return &rowBorderStyle; |
} |
DEFINE_STATIC_LOCAL(StylePropertySet, columnBorderStyle, |
- (createGroupBorderStyle(false))); |
+ (createGroupBorderStyle(false)), |
+ CheckScriptWrappable::No); |
return &columnBorderStyle; |
} |