Fix Runtime.executionContextCreated for crafted iframes.

Source/bindings/core/v8/WindowProxy.cpp

 /*
  * Copyright (C) 2008, 2009, 2011 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 88 matching lines @@
 }
 
 void WindowProxy::disposeContext(GlobalDetachmentBehavior behavior)
 {
     if (!isContextInitialized())
         return;
 
     v8::HandleScope handleScope(m_isolate);
     v8::Handle<v8::Context> context = m_scriptState->context();
     m_frame->loader().client()->willReleaseScriptContext(context, m_world->worldId());
+    InspectorInstrumentation::willReleaseScriptContext(m_frame, m_scriptState.get());

[dcheng, 2014/12/04 18:58:56]

I'm changing WindowProxy to hold a Frame, not a LocalFrame. If possible, it'd be
nice if this patch would take that into account.

[eustas, 2014/12/05 10:01:36]

OK, but let's do it in separate patch.

 
     if (behavior == DetachGlobal)
         m_scriptState->detachGlobalObject();
 
     m_scriptState->disposePerContextData();
 
     // It's likely that disposing the context has created a lot of
     // garbage. Notify V8 about this so it'll have a chance of cleaning
     // it up when idle.
     V8GCForContextDispose::instance().notifyContextDisposed(m_frame->isMainFrame());
@@ skipping 96 matching lines @@
             disposeContext(DoNotDetachGlobal);
             return false;
         }
     }
 
     if (!installDOMWindow()) {
         disposeContext(DoNotDetachGlobal);
         return false;
     }
 
+    SecurityOrigin* origin = 0;
     if (m_world->isMainWorld()) {
         // ActivityLogger for main world is updated within updateDocument().
         updateDocument();
         if (m_frame->document()) {
-            setSecurityToken(m_frame->document()->securityOrigin());
+            origin = m_frame->document()->securityOrigin();
+            setSecurityToken(origin);

[dcheng, 2014/12/04 18:58:55]

Please note I've removed this call to setSecurityToken(), since it's redundant
with updateDocument(). Unfortunately, that means the approach in this patch
won't work. Would it be possible to call
InspectorInstrumentation::didCreateScriptContext() in setSecurityToken()?

[eustas, 2014/12/05 10:01:36]

I've updated this place.
setSecurityToken doesn't seem to be right place, because there is no 1:1
relation between creation on execution context and setting origin.

             ContentSecurityPolicy* csp = m_frame->document()->contentSecurityPolicy();
             context->AllowCodeGenerationFromStrings(csp->allowEval(0, ContentSecurityPolicy::SuppressReport));
             context->SetErrorMessageForCodeGenerationFromStrings(v8String(m_isolate, csp->evalDisabledErrorMessage()));
         }
     } else {
         updateActivityLogger();
-        SecurityOrigin* origin = m_world->isolatedWorldSecurityOrigin();
+        origin = m_world->isolatedWorldSecurityOrigin();
         setSecurityToken(origin);
-        if (origin && InspectorInstrumentation::hasFrontends()) {
-            InspectorInstrumentation::didCreateIsolatedContext(m_frame, m_scriptState.get(), origin);
-        }
     }
+    if (origin)
+        InspectorInstrumentation::didCreateScriptContext(m_frame, m_scriptState.get(), origin, m_world->isMainWorld());
     m_frame->loader().client()->didCreateScriptContext(context, m_world->extensionGroup(), m_world->worldId());
     return true;
 }
 
 void WindowProxy::createContext()
 {
     // The documentLoader pointer could be 0 during frame shutdown.
     // FIXME: Can we remove this check?
     if (!m_frame->loader().documentLoader())
         return;
@@ skipping 236 matching lines @@
 
 void WindowProxy::updateSecurityOrigin(SecurityOrigin* origin)
 {
     ASSERT(m_world->isMainWorld());
     if (!isContextInitialized())
         return;
     setSecurityToken(origin);
 }
 
 } // namespace blink