binding: Creates a reject promise always in the current realm.

third_party/WebKit/Source/bindings/core/v8/GeneratedCodeHelper.h

 // Copyright 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // This file is for functions that are used only by generated code.
 // CAUTION:
 // All functions defined in this file should be used by generated code only.
 // If you want to use them from hand-written code, please find appropriate
 // location and move them to that location.
 
@@ skipping 23 matching lines @@
 // promise and returns the promise instead of throwing the exception.
 //
 // Promise-returning DOM operations are required to always return a promise
 // and to never throw an exception.
 // See also http://heycam.github.io/webidl/#es-operations
 class CORE_EXPORT ExceptionToRejectPromiseScope {
   STACK_ALLOCATED();
 
  public:
   ExceptionToRejectPromiseScope(const v8::FunctionCallbackInfo<v8::Value>& info,
-                                ScriptState* scriptState,
                                 ExceptionState& exceptionState)
       : m_info(info),
-        m_scriptState(scriptState),
         m_exceptionState(exceptionState) {}
   ~ExceptionToRejectPromiseScope() {
     if (!m_exceptionState.hadException())
       return;
 
-    v8SetReturnValue(m_info, m_exceptionState.reject(m_scriptState).v8Value());
+    // As exceptions must always be created in the current realm, reject
+    // promises must also be created in the current realm while regular promises
+    // are created in the relevant realm of the context object.
+    ScriptState* scriptState = ScriptState::forFunctionObject(m_info);

[haraken, 2016/10/18 18:46:56]

Just help me understand:

- Is ExceptionToRejectPromiseScope the only place that hits this issue? Why are
other ScriptPromise::reject()'s safe?

- If reject promises must be created in the current realm, why is it safe to
create regular promises in the relevant realm? I don't quite understand where
the difference comes from.

[Yuki, 2016/10/19 06:06:58]

Other ScriptPromise::reject() are called after we checked the origin, so even if
it's the relevant realm and not the current realm, it must be the same origin at
least.

We may want to fix all reject() callsites so that they create reject promises in
the current realm, not the relevant realm.
We check the origin in an early stage before starting using the relevant realm,
so it's okay to create regular promises in the relevant realm after we checked
the origin.  It must be the same origin.

+    v8SetReturnValue(m_info, m_exceptionState.reject(scriptState).v8Value());
   }
 
  private:
   const v8::FunctionCallbackInfo<v8::Value>& m_info;
-  ScriptState* m_scriptState;
   ExceptionState& m_exceptionState;
 };
 
 }  // namespace blink
 
 #endif  // GeneratedCodeHelper_h