Inject a prototype object of a private script into the prototype chain of a holder object

Source/bindings/core/v8/PrivateScriptRunner.cpp

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "config.h"
 #include "bindings/core/v8/PrivateScriptRunner.h"
 
 #include "bindings/core/v8/DOMWrapperWorld.h"
 #include "bindings/core/v8/ExceptionState.h"
 #include "bindings/core/v8/V8Binding.h"
@@ skipping 80 matching lines @@
         if (!initializeFunction.IsEmpty() && initializeFunction->IsFunction()) {
             v8::TryCatch block;
             V8ScriptRunner::callFunction(v8::Handle<v8::Function>::Cast(initializeFunction), scriptState->executionContext(), holder, 0, 0, isolate);
             if (block.HasCaught()) {
                 WTF_LOG_ERROR("Private script error: Object constructor threw an exception.\n");
                 if (!block.Message().IsEmpty())
                     WTF_LOG_ERROR("%s\n", toCoreString(block.Message()->Get()).utf8().data());
                 RELEASE_ASSERT_NOT_REACHED();
             }
         }
+
+        // Inject the prototype object of the private script into the prototype chain of the holder object.
+        // This is necessary to let the holder object use properties defined on the prototype object
+        // of the private script. (e.g., if the prototype object has |foo|, the holder object should be able
+        // to use it with |this.foo|.)
+        if (classObject->GetPrototype() != holderObject->GetPrototype())
+            classObject->SetPrototype(holderObject->GetPrototype());
+        holderObject->SetPrototype(classObject);
+
         isInitialized = v8Boolean(true, isolate);
         V8HiddenValue::setHiddenValue(isolate, holderObject, V8HiddenValue::privateScriptObjectIsInitialized(isolate), isInitialized);
     }
 }
 
 v8::Handle<v8::Value> PrivateScriptRunner::installClassIfNeeded(LocalFrame* frame, String className)
 {
     if (!frame)
         return v8::Handle<v8::Value>();
     v8::HandleScope handleScope(toIsolate(frame));
@@ skipping 71 matching lines @@
     RELEASE_ASSERT(!message.IsEmpty() && message->IsString());
     v8::Handle<v8::Value> code = exceptionObject->Get(v8String(isolate, "code"));
     RELEASE_ASSERT(!code.IsEmpty() && code->IsInt32());
     // FIXME: Support JavaScript errors such as TypeError, RangeError and SecurityError.
     exceptionState.throwDOMException(toInt32(code), toCoreString(v8::Handle<v8::String>::Cast(message)));
     exceptionState.throwIfNeeded();
     return true;
 }
 
 } // namespace blink