ServiceWorker: Add support for .skipWaiting and controllerchange event(1/3)

Source/modules/serviceworkers/ServiceWorkerContainer.cpp

Index: Source/modules/serviceworkers/ServiceWorkerContainer.cpp
diff --git a/Source/modules/serviceworkers/ServiceWorkerContainer.cpp b/Source/modules/serviceworkers/ServiceWorkerContainer.cpp
index de303bdd0bf4f82395dc551d46bed571962cab29..44d8a0e00bb39f0aa7a100edacc7d744bfce976a 100644
--- a/Source/modules/serviceworkers/ServiceWorkerContainer.cpp
+++ b/Source/modules/serviceworkers/ServiceWorkerContainer.cpp
@@ -42,6 +42,7 @@
 #include "core/dom/MessagePort.h"
 #include "core/events/MessageEvent.h"
 #include "core/frame/LocalDOMWindow.h"
+#include "modules/EventTargetModules.h"
 #include "modules/serviceworkers/ServiceWorker.h"
 #include "modules/serviceworkers/ServiceWorkerContainerClient.h"
 #include "modules/serviceworkers/ServiceWorkerError.h"
@@ -100,6 +101,8 @@ void ServiceWorkerContainer::trace(Visitor* visitor)
     visitor->trace(m_controller);
     visitor->trace(m_readyRegistration);
     visitor->trace(m_ready);
+    EventTargetWithInlineData::trace(visitor);
+    HeapSupplementable<ServiceWorkerContainer>::trace(visitor);
 }
 
 ScriptPromise ServiceWorkerContainer::registerServiceWorker(ScriptState* scriptState, const String& url, const RegistrationOptions& options)
@@ -232,13 +235,15 @@ static void deleteIfNoExistingOwner(WebServiceWorker* serviceWorker)
         delete serviceWorker;
 }
 
-void ServiceWorkerContainer::setController(WebServiceWorker* serviceWorker)
+void ServiceWorkerContainer::setController(WebServiceWorker* serviceWorker, bool shouldNotifyControllerChange)
 {
     if (!executionContext()) {
         deleteIfNoExistingOwner(serviceWorker);
         return;
     }
     m_controller = ServiceWorker::from(executionContext(), serviceWorker);
+    if (shouldNotifyControllerChange)
+        dispatchEvent(Event::create(EventTypeNames::controllerchange));

[tkent, 2014/12/01 07:57:13]

Is it possible to cause use-after-free by JavaScript code invoked by an event
handler?

[xiang, 2014/12/02 02:31:48]

I don't know in which case the event object will be use-after-free, would you
provide more info on this?

[tkent, 2014/12/02 02:37:07]

A web page can run any JavaScript code as a |controllerchange| event handler,
and the code can remove C++ objects referred from a JavaScript object.  I'm
afraid such code removes this ServiceWorkerContainer or a callsite object of
setController().

 }
 
 void ServiceWorkerContainer::setReadyRegistration(WebServiceWorkerRegistration* registration)
@@ -271,6 +276,11 @@ void ServiceWorkerContainer::dispatchMessageEvent(const WebString& message, cons
     executionContext()->executingWindow()->dispatchEvent(MessageEvent::create(ports.release(), value));
 }
 
+const AtomicString& ServiceWorkerContainer::interfaceName() const
+{
+    return EventTargetNames::ServiceWorkerContainer;
+}
+
 ServiceWorkerContainer::ServiceWorkerContainer(ExecutionContext* executionContext)
     : ContextLifecycleObserver(executionContext)
     , m_provider(0)