Add CHECKs to try to narrow down cause of bad internal fields in Window DOM wrapper

third_party/WebKit/Source/bindings/core/v8/WindowProxy.cpp

 /*
  * Copyright (C) 2008, 2009, 2011 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 15 matching lines @@
  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 #include "bindings/core/v8/WindowProxy.h"
 
 #include <utility>
 
 #include "bindings/core/v8/V8DOMWrapper.h"
+#include "bindings/core/v8/V8Window.h"
 #include "core/frame/Frame.h"
 #include "v8/include/v8.h"
 #include "wtf/Assertions.h"
+#include "wtf/debug/Alias.h"
 
 namespace blink {
 
 WindowProxy::~WindowProxy() {
   // clearForClose() or clearForNavigation() must be invoked before destruction
   // starts.
   DCHECK(m_lifecycle != Lifecycle::ContextInitialized);
 }
 
 DEFINE_TRACE(WindowProxy) {
@@ skipping 74 matching lines @@
 // has a security token which is the domain. The outer window cannot
 // have its own properties. window.foo = 'x' is delegated to the
 // inner window.
 //
 // When a frame navigates to a new page, the inner window is cut off
 // the outer window, and the outer window identify is preserved for
 // the frame. However, a new inner window is created for the new page.
 // If there are JS code holds a closure to the old inner window,
 // it won't be able to reach the outer window via its global object.
 void WindowProxy::initializeIfNeeded() {
+  v8::HandleScope handleScope(m_isolate);
+  Lifecycle oldLifecycle = m_lifecycle;
+  DOMWindow* window = m_frame->domWindow();
+  bool isLocal = window->isLocalDOMWindow();
+  // Prevent these locals from getting optimized out, and hopefully, the heap
+  // contents captured into minidumps.
+  WTF::debug::alias(&oldLifecycle);
+  WTF::debug::alias(&window);
+  WTF::debug::alias(&isLocal);
+
   // TODO(haraken): It is wrong to re-initialize an already detached window
   // proxy. This must be 'if(m_lifecycle == Lifecycle::ContextUninitialized)'.
   if (m_lifecycle != Lifecycle::ContextInitialized) {
     initialize();
+    // Note: this set of CHECKs is intentionally duplicated below to distinguish
+    // between initializing the global with null internal fields or returning a
+    // global that claims to be initialized but has null internal fields.
+    v8::Local<v8::Object> globalProxy = m_globalProxy.newLocal(m_isolate);
+    CHECK(!globalProxy.IsEmpty());
+    CHECK(V8Window::hasInstance(globalProxy, m_isolate));
+    CHECK(window);
+    CHECK_EQ(window, V8Window::toImpl(globalProxy));
+  } else {
+    v8::Local<v8::Object> globalProxy = m_globalProxy.newLocal(m_isolate);
+    CHECK(!globalProxy.IsEmpty());
+    CHECK(V8Window::hasInstance(globalProxy, m_isolate));
+    CHECK(window);
+    CHECK_EQ(window, V8Window::toImpl(globalProxy));
   }
+
+  // Sanity check: WindowProxy's frame's window should still be the same
+  DOMWindow* window2 = m_frame->domWindow();
+  WTF::debug::alias(&window2);
+  CHECK_EQ(window, window2);
 }
 
 }  // namespace blink