ServiceWorker: Add support for .skipWaiting and controllerchange event(1/3)

Source/modules/serviceworkers/ServiceWorkerContainer.cpp

 /*
  * Copyright (C) 2013 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 24 matching lines @@
 #include "bindings/core/v8/ScriptPromiseResolver.h"
 #include "bindings/core/v8/ScriptState.h"
 #include "bindings/core/v8/SerializedScriptValue.h"
 #include "bindings/core/v8/SerializedScriptValueFactory.h"
 #include "core/dom/DOMException.h"
 #include "core/dom/ExceptionCode.h"
 #include "core/dom/ExecutionContext.h"
 #include "core/dom/MessagePort.h"
 #include "core/events/MessageEvent.h"
 #include "core/frame/LocalDOMWindow.h"
+#include "modules/EventTargetModules.h"
 #include "modules/serviceworkers/ServiceWorker.h"
 #include "modules/serviceworkers/ServiceWorkerContainerClient.h"
 #include "modules/serviceworkers/ServiceWorkerError.h"
 #include "modules/serviceworkers/ServiceWorkerRegistration.h"
 #include "platform/RuntimeEnabledFeatures.h"
 #include "public/platform/WebServiceWorker.h"
 #include "public/platform/WebServiceWorkerProvider.h"
 #include "public/platform/WebServiceWorkerRegistration.h"
 #include "public/platform/WebString.h"
 #include "public/platform/WebURL.h"
@@ skipping 38 matching lines @@
         m_provider->setClient(0);
         m_provider = nullptr;
     }
 }
 
 void ServiceWorkerContainer::trace(Visitor* visitor)
 {
     visitor->trace(m_controller);
     visitor->trace(m_readyRegistration);
     visitor->trace(m_ready);
+    EventTargetWithInlineData::trace(visitor);
+    HeapSupplementable<ServiceWorkerContainer>::trace(visitor);
 }
 
 ScriptPromise ServiceWorkerContainer::registerServiceWorker(ScriptState* scriptState, const String& url, const RegistrationOptions& options)
 {
     ASSERT(RuntimeEnabledFeatures::serviceWorkerEnabled());
     RefPtr<ScriptPromiseResolver> resolver = ScriptPromiseResolver::create(scriptState);
     ScriptPromise promise = resolver->promise();
 
     if (!m_provider) {
         resolver->reject(DOMException::create(InvalidStateError, "The document is in an invalid state."));
@@ skipping 112 matching lines @@
 
 // If the WebServiceWorker is up for adoption (does not have a
 // WebServiceWorkerProxy owner), rejects the adoption by deleting the
 // WebServiceWorker.
 static void deleteIfNoExistingOwner(WebServiceWorker* serviceWorker)
 {
     if (serviceWorker && !serviceWorker->proxy())
         delete serviceWorker;
 }
 
-void ServiceWorkerContainer::setController(WebServiceWorker* serviceWorker)
+void ServiceWorkerContainer::setController(WebServiceWorker* serviceWorker, bool shouldNotifyControllerChange)
 {
     if (!executionContext()) {
         deleteIfNoExistingOwner(serviceWorker);
         return;
     }
     m_controller = ServiceWorker::from(executionContext(), serviceWorker);
+    if (shouldNotifyControllerChange)
+        dispatchEvent(Event::create(EventTypeNames::controllerchange));

[tkent, 2014/12/01 07:57:13]

Is it possible to cause use-after-free by JavaScript code invoked by an event
handler?

[xiang, 2014/12/02 02:31:48]

I don't know in which case the event object will be use-after-free, would you
provide more info on this?

[tkent, 2014/12/02 02:37:07]

A web page can run any JavaScript code as a |controllerchange| event handler,
and the code can remove C++ objects referred from a JavaScript object.  I'm
afraid such code removes this ServiceWorkerContainer or a callsite object of
setController().

 }
 
 void ServiceWorkerContainer::setReadyRegistration(WebServiceWorkerRegistration* registration)
 {
     if (!executionContext()) {
         ServiceWorkerRegistration::dispose(registration);
         return;
     }
 
     ServiceWorkerRegistration* readyRegistration = ServiceWorkerRegistration::from(executionContext(), registration);
@@ skipping 12 matching lines @@
 void ServiceWorkerContainer::dispatchMessageEvent(const WebString& message, const WebMessagePortChannelArray& webChannels)
 {
     if (!executionContext() || !executionContext()->executingWindow())
         return;
 
     OwnPtrWillBeRawPtr<MessagePortArray> ports = MessagePort::toMessagePortArray(executionContext(), webChannels);
     RefPtr<SerializedScriptValue> value = SerializedScriptValueFactory::instance().createFromWire(message);
     executionContext()->executingWindow()->dispatchEvent(MessageEvent::create(ports.release(), value));
 }
 
+const AtomicString& ServiceWorkerContainer::interfaceName() const
+{
+    return EventTargetNames::ServiceWorkerContainer;
+}
+
 ServiceWorkerContainer::ServiceWorkerContainer(ExecutionContext* executionContext)
     : ContextLifecycleObserver(executionContext)
     , m_provider(0)
 {
 
     if (!executionContext)
         return;
 
     m_ready = createReadyProperty();
 
     if (ServiceWorkerContainerClient* client = ServiceWorkerContainerClient::from(executionContext)) {
         m_provider = client->provider();
         if (m_provider)
             m_provider->setClient(this);
     }
 }
 
 } // namespace blink