Fix Runtime.executionContextCreated for crafted iframes.

Source/core/inspector/PageRuntimeAgent.cpp

 /*
  * Copyright (C) 2011 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 83 matching lines @@
 }
 
 void PageRuntimeAgent::didClearDocumentOfWindowObject(LocalFrame* frame)
 {
     m_mainWorldContextCreated = true;
 
     if (!m_enabled)
         return;
     ASSERT(m_frontend);
 
-    if (frame == m_inspectedPage->mainFrame()) {
-        m_scriptStateToId.clear();
-        m_frontend->executionContextsCleared();
-    }
-    String frameId = m_pageAgent->frameId(frame);
-    addExecutionContextToFrontend(ScriptState::forMainWorld(frame), true, "", frameId);
+    frame->script().initializeMainWorld();
 }
 
-void PageRuntimeAgent::didCreateIsolatedContext(LocalFrame* frame, ScriptState* scriptState, SecurityOrigin* origin)
+void PageRuntimeAgent::didCreateScriptContext(LocalFrame* frame, ScriptState* scriptState, SecurityOrigin* origin, bool isMainWorldContext)
 {
     if (!m_enabled)
         return;
     ASSERT(m_frontend);
     String originString = origin ? origin->toRawString() : "";
     String frameId = m_pageAgent->frameId(frame);
-    addExecutionContextToFrontend(scriptState, false, originString, frameId);
+    addExecutionContextToFrontend(scriptState, isMainWorldContext, originString, frameId);
+}
+
+void PageRuntimeAgent::willReleaseScriptContext(LocalFrame* frame, ScriptState* scriptState)
+{
+    injectedScriptManager()->discardInjectedScriptFor(scriptState);
+    ScriptStateToId::iterator it = m_scriptStateToId.find(scriptState);
+    if (it == m_scriptStateToId.end())
+        return;
+    int id = it->value;
+    m_scriptStateToId.remove(scriptState);
+    m_frontend->executionContextDestroyed(id);
 }
 
 InjectedScript PageRuntimeAgent::injectedScriptForEval(ErrorString* errorString, const int* executionContextId)
 {
     if (!executionContextId) {
         ScriptState* scriptState = ScriptState::forMainWorld(m_inspectedPage->deprecatedLocalMainFrame());
         InjectedScript result = injectedScriptManager()->injectedScriptFor(scriptState);
         if (result.isEmpty())
             *errorString = "Internal error: main world execution context not found.";
         return result;
@@ skipping 18 matching lines @@
 {
     Vector<std::pair<ScriptState*, SecurityOrigin*> > isolatedContexts;
     for (Frame* frame = m_inspectedPage->mainFrame(); frame; frame = frame->tree().traverseNext()) {
         if (!frame->isLocalFrame())
             continue;
         LocalFrame* localFrame = toLocalFrame(frame);
         if (!localFrame->script().canExecuteScripts(NotAboutToExecuteScript))
             continue;
         String frameId = m_pageAgent->frameId(localFrame);
 
-        ScriptState* scriptState = ScriptState::forMainWorld(localFrame);
-        addExecutionContextToFrontend(scriptState, true, "", frameId);
+        // Ensure execution context is created.
+        // If initializeMainWorld returns true, then is registered by didCreateScriptContext
+        if (!localFrame->script().initializeMainWorld())
+            addExecutionContextToFrontend(ScriptState::forMainWorld(localFrame), true, "", frameId);
         localFrame->script().collectIsolatedContexts(isolatedContexts);
         if (isolatedContexts.isEmpty())
             continue;
         for (const auto& pair : isolatedContexts) {
             String originString = pair.second ? pair.second->toRawString() : "";
             addExecutionContextToFrontend(pair.first, false, originString, frameId);
         }
         isolatedContexts.clear();
     }
 }
 
-void PageRuntimeAgent::frameWindowDiscarded(LocalDOMWindow* window)
-{
-    Vector<RefPtr<ScriptState> > scriptStatesToRemove;
-    for (ScriptStateToId::iterator it = m_scriptStateToId.begin(); it != m_scriptStateToId.end(); ++it) {
-        RefPtr<ScriptState> scriptState = it->key;
-        if (!scriptState->contextIsValid() || window == scriptState->domWindow()) {
-            scriptStatesToRemove.append(scriptState);
-            m_frontend->executionContextDestroyed(it->value);
-        }
-    }
-    m_scriptStateToId.removeAll(scriptStatesToRemove);
-    injectedScriptManager()->discardInjectedScriptsFor(window);
-}
-
 } // namespace blink