binding: Creates a reject promise always in the current realm.

third_party/WebKit/Source/bindings/core/v8/GeneratedCodeHelper.h

Index: third_party/WebKit/Source/bindings/core/v8/GeneratedCodeHelper.h
diff --git a/third_party/WebKit/Source/bindings/core/v8/GeneratedCodeHelper.h b/third_party/WebKit/Source/bindings/core/v8/GeneratedCodeHelper.h
index 7ae374b518de2d4a750f35a397bb60c9535875e6..2a269a8220134c71ea9ac7ea83bd608983023f1c 100644
--- a/third_party/WebKit/Source/bindings/core/v8/GeneratedCodeHelper.h
+++ b/third_party/WebKit/Source/bindings/core/v8/GeneratedCodeHelper.h
@@ -41,21 +41,22 @@ class CORE_EXPORT ExceptionToRejectPromiseScope {
 
  public:
   ExceptionToRejectPromiseScope(const v8::FunctionCallbackInfo<v8::Value>& info,
-                                ScriptState* scriptState,
                                 ExceptionState& exceptionState)
       : m_info(info),
-        m_scriptState(scriptState),
         m_exceptionState(exceptionState) {}
   ~ExceptionToRejectPromiseScope() {
     if (!m_exceptionState.hadException())
       return;
 
-    v8SetReturnValue(m_info, m_exceptionState.reject(m_scriptState).v8Value());
+    // As exceptions must always be created in the current realm, reject
+    // promises must also be created in the current realm while regular promises
+    // are created in the relevant realm of the context object.
+    ScriptState* scriptState = ScriptState::forFunctionObject(m_info);

[haraken, 2016/10/18 18:46:56]

Just help me understand:

- Is ExceptionToRejectPromiseScope the only place that hits this issue? Why are
other ScriptPromise::reject()'s safe?

- If reject promises must be created in the current realm, why is it safe to
create regular promises in the relevant realm? I don't quite understand where
the difference comes from.

[Yuki, 2016/10/19 06:06:58]

Other ScriptPromise::reject() are called after we checked the origin, so even if
it's the relevant realm and not the current realm, it must be the same origin at
least.

We may want to fix all reject() callsites so that they create reject promises in
the current realm, not the relevant realm.
We check the origin in an early stage before starting using the relevant realm,
so it's okay to create regular promises in the relevant realm after we checked
the origin.  It must be the same origin.

+    v8SetReturnValue(m_info, m_exceptionState.reject(scriptState).v8Value());
   }
 
  private:
   const v8::FunctionCallbackInfo<v8::Value>& m_info;
-  ScriptState* m_scriptState;
   ExceptionState& m_exceptionState;
 };