Merge 96991 - https://bugs.webkit.org/show_bug.cgi?id=69471

Source/WebCore/bindings/v8/ScriptController.cpp

 /*
  * Copyright (C) 2008, 2009 Google Inc. All rights reserved.
  * Copyright (C) 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
@@ skipping 27 matching lines @@
 #include "ScriptCallStackFactory.h"
 #include "ScriptableDocumentParser.h"
 #include "DOMWindow.h"
 #include "Event.h"
 #include "EventListener.h"
 #include "EventNames.h"
 #include "Frame.h"
 #include "FrameLoaderClient.h"
 #include "Node.h"
 #include "NotImplemented.h"
+#include "NPObjectWrapper.h"
 #include "npruntime_impl.h"
 #include "npruntime_priv.h"
 #include "NPV8Object.h"
 #include "ScriptSourceCode.h"
 #include "SecurityOrigin.h"
 #include "Settings.h"
 #include "UserGestureIndicator.h"
 #include "V8Binding.h"
 #include "V8BindingState.h"
 #include "V8DOMWindow.h"
@@ skipping 48 matching lines @@
     return V8BindingSecurity::canAccessFrame(V8BindingState::Only(), target, true);
 }
 
 ScriptController::ScriptController(Frame* frame)
     : m_frame(frame)
     , m_sourceURL(0)
     , m_inExecuteScript(false)
     , m_paused(false)
     , m_proxy(adoptPtr(new V8Proxy(frame)))
 #if ENABLE(NETSCAPE_PLUGIN_API)
-    , m_windowScriptNPObject(0)
+    , m_wrappedWindowScriptNPObject(0)
 #endif
 {
 }
 
 ScriptController::~ScriptController()
 {
 }
 
 void ScriptController::clearScriptObjects()
 {
     PluginObjectMap::iterator it = m_pluginObjects.begin();
     for (; it != m_pluginObjects.end(); ++it) {
         _NPN_UnregisterObject(it->second);
         _NPN_ReleaseObject(it->second);
     }
     m_pluginObjects.clear();
 
 #if ENABLE(NETSCAPE_PLUGIN_API)
-    if (m_windowScriptNPObject) {
+    if (m_wrappedWindowScriptNPObject) {
+        NPObjectWrapper* windowScriptObjectWrapper = NPObjectWrapper::getWrapper(m_wrappedWindowScriptNPObject);
+        ASSERT(windowScriptObjectWrapper);
+
+        NPObject* windowScriptNPObject = NPObjectWrapper::getUnderlyingNPObject(m_wrappedWindowScriptNPObject);
+        ASSERT(windowScriptNPObject);
         // Call _NPN_DeallocateObject() instead of _NPN_ReleaseObject() so that we don't leak if a plugin fails to release the window
         // script object properly.
         // This shouldn't cause any problems for plugins since they should have already been stopped and destroyed at this point.
-        _NPN_DeallocateObject(m_windowScriptNPObject);
-        m_windowScriptNPObject = 0;
+        _NPN_DeallocateObject(windowScriptNPObject);
+
+        // Clear out the wrapped window script object pointer held by the wrapper.
+        windowScriptObjectWrapper->clear();
+        _NPN_ReleaseObject(m_wrappedWindowScriptNPObject);
+        m_wrappedWindowScriptNPObject = 0;
     }
 #endif
 }
 
 void ScriptController::updateSecurityOrigin()
 {
     m_proxy->windowShell()->updateSecurityOrigin();
 }
 
 void ScriptController::updatePlatformScriptObjects()
@@ skipping 201 matching lines @@
 
     v8::Context::Scope scope(v8Context);
     DOMWindow* window = frame->domWindow();
     v8::Handle<v8::Value> global = toV8(window);
     ASSERT(global->IsObject());
     return npCreateV8ScriptObject(0, v8::Handle<v8::Object>::Cast(global), window);
 }
 
 NPObject* ScriptController::windowScriptNPObject()
 {
-    if (m_windowScriptNPObject)
-        return m_windowScriptNPObject;
+    if (m_wrappedWindowScriptNPObject)
+        return m_wrappedWindowScriptNPObject;
 
+    NPObject* windowScriptNPObject = 0;
     if (canExecuteScripts(NotAboutToExecuteScript)) {
         // JavaScript is enabled, so there is a JavaScript window object.
         // Return an NPObject bound to the window object.
-        m_windowScriptNPObject = createScriptObject(m_frame);
-        _NPN_RegisterObject(m_windowScriptNPObject, 0);
+        windowScriptNPObject = createScriptObject(m_frame);
+        _NPN_RegisterObject(windowScriptNPObject, 0);
     } else {
         // JavaScript is not enabled, so we cannot bind the NPObject to the
         // JavaScript window object. Instead, we create an NPObject of a
         // different class, one which is not bound to a JavaScript object.
-        m_windowScriptNPObject = createNoScriptObject();
+        windowScriptNPObject = createNoScriptObject();
     }
-    return m_windowScriptNPObject;
+
+    m_wrappedWindowScriptNPObject = NPObjectWrapper::create(windowScriptNPObject);
+    return m_wrappedWindowScriptNPObject;
 }
 
 NPObject* ScriptController::createScriptObjectForPluginElement(HTMLPlugInElement* plugin)
 {
     // Can't create NPObjects when JavaScript is disabled.
     if (!canExecuteScripts(NotAboutToExecuteScript))
         return createNoScriptObject();
 
     v8::HandleScope handleScope;
     v8::Handle<v8::Context> v8Context = V8Proxy::mainWorldContext(m_frame);
@@ skipping 39 matching lines @@
 {
     m_proxy->windowShell()->namedItemAdded(doc, name);
 }
 
 void ScriptController::namedItemRemoved(HTMLDocument* doc, const AtomicString& name)
 {
     m_proxy->windowShell()->namedItemRemoved(doc, name);
 }
 
 } // namespace WebCore