Bug 112191 - [v8] [meta] Binding Integrity should move off of vtable checks.
Summary: [v8] [meta] Binding Integrity should move off of vtable checks.
Status: RESOLVED INVALID
Alias: None
Product: WebKit
Classification: Unclassified
Component: WebCore Misc. (show other bugs)
Version: 528+ (Nightly build)
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Nobody
URL:
Keywords:
Depends on: 112613 112848 113247
Blocks: 107168
  Show dependency treegraph
 
Reported: 2013-03-12 14:46 PDT by Thomas Sepez
Modified: 2014-12-16 00:48 PST (History)
7 users (show)

See Also:


Attachments
WIP. (149.55 KB, patch)
2013-03-12 14:47 PDT, Thomas Sepez
no flags Details | Formatted Diff | Diff
WIP. (153.10 KB, patch)
2013-03-13 13:10 PDT, Thomas Sepez
no flags Details | Formatted Diff | Diff
WIP. (183.79 KB, patch)
2013-03-14 17:12 PDT, Thomas Sepez
no flags Details | Formatted Diff | Diff
WIP. (179.92 KB, patch)
2013-03-18 14:59 PDT, Thomas Sepez
no flags Details | Formatted Diff | Diff
WIP. (210.39 KB, patch)
2013-03-21 12:17 PDT, Thomas Sepez
no flags Details | Formatted Diff | Diff
WIP. (208.73 KB, patch)
2013-03-29 11:00 PDT, Thomas Sepez
abarth: review-
Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Thomas Sepez 2013-03-12 14:46:05 PDT
Tracking bug for forthcoming effort.
Comment 1 Thomas Sepez 2013-03-12 14:47:19 PDT
Created attachment 192811 [details]
WIP.

Patch for discussion of direction.
Comment 2 Adam Barth 2013-03-12 15:23:16 PDT
Comment on attachment 192811 [details]
WIP.

View in context: https://bugs.webkit.org/attachment.cgi?id=192811&action=review

> WebCore/page/History.idl:36
> +    IsScriptWrappable

We tried to avoid having an IDL attribute for script wrappable.  Instead we used C++ tricks to automatically detect a ScriptWrappable base class.
Comment 3 Thomas Sepez 2013-03-12 15:27:55 PDT
(In reply to comment #2)
> (From update of attachment 192811 [details])
> View in context: https://bugs.webkit.org/attachment.cgi?id=192811&action=review
> 
> > WebCore/page/History.idl:36
> > +    IsScriptWrappable
> 
> We tried to avoid having an IDL attribute for script wrappable.  Instead we used C++ tricks to automatically detect a ScriptWrappable base class.

Yeah.  It's hard, though, because the info is used to change the initialization of a const POD struct.  The bright side is only the classes that directly depend on scriptwrappable need to mention this, the rest is inferred via inherited IDL attributes.
Comment 4 Adam Barth 2013-03-12 15:38:54 PDT
Comment on attachment 192811 [details]
WIP.

View in context: https://bugs.webkit.org/attachment.cgi?id=192811&action=review

> WebCore/bindings/v8/ScriptWrappable.h:133
> +template <typename T>void initWrappable(T* object);

I thought we were going to do this in adoptPtr so that we wouldn't have to write this boilerplate code in every class...
Comment 5 Adam Barth 2013-03-12 15:43:46 PDT
> Yeah.  It's hard, though, because the info is used to change the initialization of a const POD struct.  The bright side is only the classes that directly depend on scriptwrappable need to mention this, the rest is inferred via inherited IDL attributes.

That should be doable with template specialization, which is the trick we use elsewhere to autodetect ScriptWrappable.
Comment 6 Thomas Sepez 2013-03-13 09:40:23 PDT
> I thought we were going to do this in adoptPtr so that we wouldn't have to write this boilerplate code in every class...

Apart from being counter-intuitive that adoptPtr would do this, it creates the need to have a single centralized file generated from the .idl that lists all of the possible entry adoptPtr varieties in one place.  This then gets included everywhere, such that a small perturbation in any idl file triggers a large rebuild.  Seemed opposite to the decentralized approach we seem to favor.
Comment 7 Thomas Sepez 2013-03-13 13:10:57 PDT
Created attachment 192977 [details]
WIP.

Patch resolves the need for IsScriptWrappable IDL attribute.  We always generate the initWrappable() code; some of these will compile into nothingness.  Thing to note is that I moved some of the static methods from DOMDataStore.h to scriptwrapable and minor name changes.
Comment 8 Adam Barth 2013-03-13 13:18:51 PDT
Comment on attachment 192977 [details]
WIP.

View in context: https://bugs.webkit.org/attachment.cgi?id=192977&action=review

> Source/WebCore/bindings/scripts/CodeGeneratorV8.pm:2020
> -    V8DOMWrapper::associateObjectWithWrapper(impl.release(), &V8${interfaceName}::info, wrapper, args.GetIsolate(), WrapperConfiguration::Dependent);
> +    V8DOMWrapper::associateObjectWithWrapper(impl.release().get(), &V8${interfaceName}::info, wrapper, args.GetIsolate(), WrapperConfiguration::Dependent);

impl.release().get()   <---  This is the same as impl.get()

> Source/WebCore/bindings/v8/NPV8Object.cpp:54
> -    static WrapperTypeInfo typeInfo = { 0, 0, 0, 0, 0, 0, 0, WrapperTypeObjectPrototype };
> +  static WrapperTypeInfo typeInfo = { 0, 0, 0, 0, 0, 0, 0, WrapperTypeObjectPrototype, 0 };

bad indent?

> Source/WebCore/bindings/v8/ScriptWrappable.h:71
> +   void setTypeInfo(const WrapperTypeInfo* info)

bad indent
Comment 9 Adam Barth 2013-03-13 13:20:44 PDT
Ok, this looks workable.  Can you break this patch into smaller, reviewable pieces?  Maybe...

1) Move functions to ScriptWrappable.h
2) Generate any empty initScriptWrappable function and add callers
3) The rest

?
Comment 10 Thomas Sepez 2013-03-13 14:52:20 PDT
(In reply to comment #9)
> Ok, this looks workable.  Can you break this patch into smaller, reviewable pieces?  Maybe...
> 
> 1) Move functions to ScriptWrappable.h
> 2) Generate any empty initScriptWrappable function and add callers
Strikes me this should be templated static method ScriptWrappable::init().

> 3) The rest
> 
> ?
Comment 11 Thomas Sepez 2013-03-14 17:12:16 PDT
Created attachment 193207 [details]
WIP.

ScriptWrappable: note use of function template to call external function in place of function template with no body (c++ standard violation corrected).  Also note retrieval of typeinfo from wrapper when wrapper replaces typeinfo in slot.
Comment 12 Adam Barth 2013-03-15 13:59:32 PDT
> Strikes me this should be templated static method ScriptWrappable::init().

Sure.
Comment 13 Thomas Sepez 2013-03-18 14:57:10 PDT
Making this a meta bug.  Will be adding one last WIP set, then break this into smaller pieces.
Comment 14 Thomas Sepez 2013-03-18 14:59:24 PDT
Created attachment 193663 [details]
WIP.
Comment 15 Thomas Sepez 2013-03-18 17:21:09 PDT
Latest hangup: wrapping custom elements.  There is no HTMLCustomElement class from which to initialize a wrapper, which makes it hard to cover the special case for it that formerly existed in HTMLElementWrapperFactory.
Comment 16 Adam Barth 2013-03-19 09:46:36 PDT
Maybe morrita has ideas for how to address the custom element issue?
Comment 17 Hajime Morrita 2013-03-20 19:22:18 PDT
> Latest hangup: wrapping custom elements.  There is no HTMLCustomElement class from which to initialize a wrapper, which makes it hard to cover the special case for it that formerly existed in HTMLElementWrapperFactory.

In my understanding, you're telling WrapperTypeInfo to each C++ wrapable objects, right?
In that case, I don't think you need any extra work for custom elements.

As you mentioned, there is no C++ HTMLCustomElement class, 
There is no WrapperTypeInfo for custom element either. 
Each custom element is backed by one of either HTMLElement class or its subclasses,
both of which you already instrumented in the latest WIP patch.
So any custom element should already have a WrapperTypeInfo installed with the patch.

Does this make sense?
Comment 18 Thomas Sepez 2013-03-21 12:17:42 PDT
Created attachment 194314 [details]
WIP.

Fix custom elements by upgrading cached wrapper type info when is=xxx attribute is parsed.
Comment 19 Hajime Morrita 2013-03-21 17:23:25 PDT
Comment on attachment 194314 [details]
WIP.

View in context: https://bugs.webkit.org/attachment.cgi?id=194314&action=review

> third_party/WebKit/Source/WebCore/bindings/v8/custom/V8CustomElementConstructorCustom.cpp:56
> +    object->setTypeInfo(&V8CustomElement::info);

It looks you are working on an old version. There is no V8CustomElement::info anymore.
Comment 20 Hajime Morrita 2013-03-21 17:28:12 PDT
Comment on attachment 194314 [details]
WIP.

View in context: https://bugs.webkit.org/attachment.cgi?id=194314&action=review

> third_party/WebKit/Source/WebCore/bindings/v8/V8CustomElement.cpp:47
> +WrapperTypeInfo V8CustomElement::info = { 0, 0, 0, 0, 0, 0, 0, WrapperTypeObjectPrototype, reinterpret_cast<WrapObjectFunction>(V8CustomElement::createWrapper) };

This is confusing. We have no CustomElement C++ class to be wrapped.
Custom elements are rather mechanism, not a single class.

I admit that name V8CustomElement was misleading.
This should've been named CustomElementConstructorInjector or something like that.
Comment 21 Thomas Sepez 2013-03-21 17:37:43 PDT
(In reply to comment #19)
> (From update of attachment 194314 [details])
> View in context: https://bugs.webkit.org/attachment.cgi?id=194314&action=review
> 
> > third_party/WebKit/Source/WebCore/bindings/v8/custom/V8CustomElementConstructorCustom.cpp:56
> > +    object->setTypeInfo(&V8CustomElement::info);
> 
> It looks you are working on an old version. There is no V8CustomElement::info anymore.
Actually, I re-introduced it.  I need a WrapperTypeInfo to hold a pointer to the createWrapper function that will invoke your constructor mechanism.  You're right that it should be named something else.

In the new world, custom elements, being elements and hence scriptwrappables, need to get a pointer to a wrappertypeinfo assigned at creation time.  It needs to be different based upon whether it's an ordinary or custom element (the latter invoking you constructor mechanism).
Comment 22 Thomas Sepez 2013-03-22 15:07:26 PDT
Hajime, would it make sense to rename class V8CustomElement to V8CustomElementConstructorCaller (which seems closest to me to the actual intention)?
Comment 23 Hajime Morrita 2013-03-24 18:50:49 PDT
(In reply to comment #21)
> 
> In the new world, custom elements, being elements and hence scriptwrappables, need to get a pointer to a wrappertypeinfo assigned at creation time.  It needs to be different based upon whether it's an ordinary or custom element (the latter invoking you constructor mechanism).

I'm sorry but I don't quite understand.
Currently we don't use WrapperTypeInfo to determine whether the element is custom element or not.
Why this change makes it required?

(In reply to comment #22)
> Hajime, would it make sense to rename class V8CustomElement to V8CustomElementConstructorCaller (which seems closest to me to the actual intention)?

Or we can just merge it CustomElementHelper.
File bug 113165 for this.
Comment 24 Thomas Sepez 2013-03-25 09:33:22 PDT
> I'm sorry but I don't quite understand.
> Currently we don't use WrapperTypeInfo to determine whether the element is custom element or not.
> Why this change makes it required?
> 
Ah.  We want to harden the binding system against certain types of deliberate tampering, with the result that the wrapper factories, with their introspection, need to go away.  As such, a scriptwrappable will always get wrapped in the new world via indirection off of its pointer to a WrapperTypeInfo as set at object creation time (the wrapper type info is then amended to include the wrapper creation function pointer).

So, we need to have a stubb WrapperTypeInfo just to allow us to transfer control to the wrapper function  in the exact same manner as any other scriptwrappable without invoking additional logic.
Comment 25 Thomas Sepez 2013-03-29 11:00:29 PDT
Created attachment 195765 [details]
WIP.

Keeping pace with changes to custom element helpers.
Comment 26 Adam Barth 2013-03-30 10:57:04 PDT
Comment on attachment 195765 [details]
WIP.

This patch is too large.  I thought we talked about splitting this patch into smaller pieces.
Comment 27 Brian Burg 2014-12-16 00:48:13 PST
Closing some V8-related work items.