Make UseCounter take a LocaFrame instead of any Frame

third_party/WebKit/Source/bindings/core/v8/custom/V8WindowCustom.cpp

 /*
  * Copyright (C) 2009, 2011 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 199 matching lines @@
   // None of these need to be RefPtr because info and context are guaranteed
   // to hold on to them.
   DOMWindow* window = V8Window::toImpl(info.Holder());
   // TODO(yukishiino): The HTML spec specifies that we should use the
   // Incumbent Realm instead of the Current Realm, but currently we don't have
   // a way to retrieve the Incumbent Realm.  See also:
   // https://html.spec.whatwg.org/multipage/comms.html#dom-window-postmessage
   LocalDOMWindow* source = CurrentDOMWindow(info.GetIsolate());
 
   DCHECK(window);
-  UseCounter::Count(window->GetFrame(), UseCounter::kWindowPostMessage);
+  UseCounter::Count(source->GetFrame(), UseCounter::kWindowPostMessage);
 
   // If called directly by WebCore we don't have a calling context.
   if (!source) {
     exception_state.ThrowTypeError("No active calling context exists.");
     return;
   }
 
   // This function has variable arguments and can be:
   //   postMessage(message, targetOrigin)
   //   postMessage(message, targetOrigin, {sequence of transferrables})
@@ skipping 80 matching lines @@
 
   // Note that named access on WindowProxy is allowed in the cross-origin case.
   // 7.4.5 [[GetOwnProperty]] (P), step 6.
   // https://html.spec.whatwg.org/multipage/browsers.html#windowproxy-getownproperty
   //
   // 7.3.3 Named access on the Window object
   // The document-tree child browsing context name property set
   // https://html.spec.whatwg.org/multipage/browsers.html#document-tree-child-browsing-context-name-property-set
   Frame* child = frame->Tree().ScopedChild(name);
   if (child) {
-    UseCounter::Count(window->GetFrame(),
+    UseCounter::Count(CurrentExecutionContext(info.GetIsolate()),

[haraken, 2017/05/15 03:40:45]

This will work as expected because CurrentExecutionContext returns nullptr for a
remote frame and UseCounter::Count ignores the nullptr execution context.

However, I'd prefer using an explicit isLocalFrame check to make the logic
explicit.

[dcheng, 2017/05/15 04:04:02]

I'm not sure I follow: I don't think CurrentExecutionContext() can ever
correspond to a context that belongs to a remote frame (since a remote frame's
context can't be entered).

[haraken, 2017/05/15 04:45:45]

CurrentExecutionContext() returns nullptr for a remote frame. UseCounter::Count
ignores it. As a result, this line is no-op for a remote frame.

I'm just suggesting making the logic more explicit using the IsLocalFrame check.

[dcheng, 2017/05/15 04:57:30]

Right, but CurrentExecutionContext() gets it from
v8::Isolate::GetCurrentContext(), right? It's impossible for v8 to enter a
v8::Context that does not correspond to a LocalFrame.

Thus, even though the bindings code internally looks like it needs to handle the
RemoteFrame case, it's actually impossible. (I agree this is confusing)

                       UseCounter::kNamedAccessOnWindow_ChildBrowsingContext);
 
     // step 3. Remove each browsing context from childBrowsingContexts whose
     // active document's origin is not same origin with activeDocument's origin
     // and whose browsing context name does not match the name of its browsing
     // context container's name content attribute value.
     if (BindingSecurity::ShouldAllowNamedAccessTo(window, child->DomWindow()) ||
         name == child->Owner()->BrowsingContextContainerName()) {
       V8SetReturnValueFast(info, child->DomWindow(), window);
       return;
     }
 
     UseCounter::Count(
-        window->GetFrame(),
+        CurrentExecutionContext(info.GetIsolate()),

[haraken, 2017/05/15 03:40:45]

Ditto.

         UseCounter::
             kNamedAccessOnWindow_ChildBrowsingContext_CrossOriginNameMismatch);
     // In addition to the above spec'ed case, we return the child window
     // regardless of step 3 due to crbug.com/701489 for the time being.
     // TODO(yukishiino): Makes iframe.name update the browsing context name
     // appropriately and makes the new name available in the named access on
     // window.  Then, removes the following two lines.
     V8SetReturnValueFast(info, child->DomWindow(), window);
     return;
   }
@@ skipping 35 matching lines @@
     if (items->HasExactlyOneItem()) {
       V8SetReturnValueFast(info, items->item(0), window);
       return;
     }
     V8SetReturnValueFast(info, items, window);
     return;
   }
 }
 
 }  // namespace blink