Revert "Revert "Replace ScriptWrappable pointer masking with back-pointer check in DOMDataStore.""

Source/bindings/v8/DOMDataStore.h

 /*
  * Copyright (C) 2009 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 43 matching lines @@
     template<typename T, typename HolderContainer, typename Wrappable>
     static v8::Handle<v8::Object> getWrapperFast(T* object, const HolderContainer& container, Wrappable* holder)
     {
         // What we'd really like to check here is whether we're in the
         // main world or in an isolated world. The fastest way to do that
         // is to check that there is no isolated world and the 'object'
         // is an object that can exist in the main world. The second fastest
         // way is to check whether the wrappable's wrapper is the same as
         // the holder.
         if ((!DOMWrapperWorld::isolatedWorldsExist() && !canExistInWorker(object)) || holderContainsWrapper(container, holder)) {
-            if (ScriptWrappable::wrapperCanBeStoredInObject(object))
-                return ScriptWrappable::getUnsafeWrapperFromObject(object).handle();
+            if (ScriptWrappable::wrapperCanBeStoredInObject(object)) {
+                v8::Handle<v8::Object> result = ScriptWrappable::getUnsafeWrapperFromObject(object).handle();
+                // Security: always guard against malicious tampering.
+                RELEASE_ASSERT(result.IsEmpty() || result->GetAlignedPointerFromInternalField(v8DOMWrapperObjectIndex) == static_cast<void*>(object));
+                return result;
+            }
             return mainWorldStore()->m_wrapperMap.get(object);
         }
         return current(container.GetIsolate())->get(object);
     }
 
     template<typename T>
     static v8::Handle<v8::Object> getWrapper(T* object, v8::Isolate* isolate)
     {
         if (ScriptWrappable::wrapperCanBeStoredInObject(object) && !canExistInWorker(object)) {
-            if (LIKELY(!DOMWrapperWorld::isolatedWorldsExist()))
-                return ScriptWrappable::getUnsafeWrapperFromObject(object).handle();
+            if (LIKELY(!DOMWrapperWorld::isolatedWorldsExist())) {
+                v8::Handle<v8::Object> result = ScriptWrappable::getUnsafeWrapperFromObject(object).handle();
+                // Security: always guard against malicious tampering.
+                RELEASE_ASSERT(result.IsEmpty() || result->GetAlignedPointerFromInternalField(v8DOMWrapperObjectIndex) == static_cast<void*>(object));
+                return result;
+            }
         }
         return current(isolate)->get(object);
     }
 
     template<typename T>
     static v8::Handle<v8::Object> getWrapperForMainWorld(T* object)
     {
         if (ScriptWrappable::wrapperCanBeStoredInObject(object))
             return ScriptWrappable::getUnsafeWrapperFromObject(object).handle();
         return mainWorldStore()->get(object);
@@ skipping 65 matching lines @@
     WrapperTypeInfo* type = toWrapperTypeInfo(wrapper);
     ASSERT(type->derefObjectFunction);
     void* key = static_cast<void*>(toNative(wrapper));
     map->removeAndDispose(key, wrapper, isolate);
     type->derefObject(key);
 }
 
 } // namespace WebCore
 
 #endif // DOMDataStore_h