Add security checks to scheduled actions

third_party/WebKit/Source/core/frame/DOMWindowTimers.cpp

 /*
  * Copyright (C) 2006, 2007, 2008, 2010 Apple Inc. All rights reserved.
  * Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies)
  * Copyright (C) 2013 Samsung Electronics. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
@@ skipping 67 matching lines @@
                int timeout,
                const Vector<ScriptValue>& arguments) {
   ExecutionContext* executionContext = eventTarget.getExecutionContext();
   if (!isAllowed(scriptState, executionContext, false))
     return 0;
   if (timeout >= 0 && executionContext->isDocument()) {
     // FIXME: Crude hack that attempts to pass idle time to V8. This should
     // be done using the scheduler instead.
     V8GCForContextDispose::instance().notifyIdle();
   }
-  ScheduledAction* action =
-      ScheduledAction::create(scriptState, handler, arguments);
+  ScheduledAction* action = ScheduledAction::create(
+      scriptState, executionContext, handler, arguments);
   return DOMTimer::install(executionContext, action, timeout, true);
 }
 
 int setTimeout(ScriptState* scriptState,
                EventTarget& eventTarget,
                const String& handler,
                int timeout,
                const Vector<ScriptValue>&) {
   ExecutionContext* executionContext = eventTarget.getExecutionContext();
   if (!isAllowed(scriptState, executionContext, true))
     return 0;
   // Don't allow setting timeouts to run empty functions.  Was historically a
   // perfomance issue.
   if (handler.isEmpty())
     return 0;
   if (timeout >= 0 && executionContext->isDocument()) {
     // FIXME: Crude hack that attempts to pass idle time to V8. This should
     // be done using the scheduler instead.
     V8GCForContextDispose::instance().notifyIdle();
   }
-  ScheduledAction* action = ScheduledAction::create(scriptState, handler);
+  ScheduledAction* action =
+      ScheduledAction::create(scriptState, executionContext, handler);
   return DOMTimer::install(executionContext, action, timeout, true);
 }
 
 int setInterval(ScriptState* scriptState,
                 EventTarget& eventTarget,
                 const ScriptValue& handler,
                 int timeout,
                 const Vector<ScriptValue>& arguments) {
   ExecutionContext* executionContext = eventTarget.getExecutionContext();
   if (!isAllowed(scriptState, executionContext, false))
     return 0;
-  ScheduledAction* action =
-      ScheduledAction::create(scriptState, handler, arguments);
+  ScheduledAction* action = ScheduledAction::create(
+      scriptState, executionContext, handler, arguments);
   return DOMTimer::install(executionContext, action, timeout, false);
 }
 
 int setInterval(ScriptState* scriptState,
                 EventTarget& eventTarget,
                 const String& handler,
                 int timeout,
                 const Vector<ScriptValue>&) {
   ExecutionContext* executionContext = eventTarget.getExecutionContext();
   if (!isAllowed(scriptState, executionContext, true))
     return 0;
   // Don't allow setting timeouts to run empty functions.  Was historically a
   // perfomance issue.
   if (handler.isEmpty())
     return 0;
-  ScheduledAction* action = ScheduledAction::create(scriptState, handler);
+  ScheduledAction* action =
+      ScheduledAction::create(scriptState, executionContext, handler);
   return DOMTimer::install(executionContext, action, timeout, false);
 }
 
 void clearTimeout(EventTarget& eventTarget, int timeoutID) {
   if (ExecutionContext* context = eventTarget.getExecutionContext())
     DOMTimer::removeByID(context, timeoutID);
 }
 
 void clearInterval(EventTarget& eventTarget, int timeoutID) {
   if (ExecutionContext* context = eventTarget.getExecutionContext())
     DOMTimer::removeByID(context, timeoutID);
 }
 
 }  // namespace DOMWindowTimers
 
 }  // namespace blink