<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[201808] trunk</title>
</head>
<body>

<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt;  }
#msg dl a { font-weight: bold}
#msg dl a:link    { color:#fc3; }
#msg dl a:active  { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff  {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta">
<dt>Revision</dt> <dd><a href="http://trac.webkit.org/projects/webkit/changeset/201808">201808</a></dd>
<dt>Author</dt> <dd>cdumez@apple.com</dd>
<dt>Date</dt> <dd>2016-06-08 10:31:12 -0700 (Wed, 08 Jun 2016)</dd>
</dl>

<h3>Log Message</h3>
<pre>self.hasOwnProperty() does not work inside Web workers
https://bugs.webkit.org/show_bug.cgi?id=158446
&lt;rdar://problem/26638397&gt;

Reviewed by Geoffrey Garen.

Source/JavaScriptCore:

Add a factory function to JSProxy to create a JSProxy without a target.
Also make the setTarget() method public so that the target can now be
set after creation. This is needed so that we can create a proxy for
JSWorkerGlobalScope, then create the JSWorkerGlobalScope object,
passing it the proxy and finally set the target on the proxy.

* runtime/JSProxy.h:
(JSC::JSProxy::create):

Source/WebCore:

W3C tests for workers were severely broken on WebKit because
self.hasOwnProperty() did not work inside workers. The reason is that
hasOwnProperty() (and other methods like toString()) call toThis() in
StrictMode on thisValue. However, in the case of 'self' in workers,
self was a DedicatedWorkerGlobalScope, which is a JSGlobalObject.
JSGlobalObject::toThis() returns jsUndefined() when called in strict
mode. As a result, we would end up with exceptions such as &quot;undefined
is not an object&quot; when calling self.hasOwnProperty() in workers.

To address the problem, this patch introduces a JSProxy whose proxy
type is PureForwardingProxyType and whose target is the
WorkerGlobalScope. This JSProxy is what we expose to the JavaScript,
instead of the JSWorkerGlobalScope itself. As a result, toThis() now
behaves as expected and self.hasOwnProperty() works inside workers.

This patch greatly improves our pass rate on several W3C tests:
http://w3c-test.org/workers/interfaces.worker: 20 passes -&gt; 50 passes (out of 128)
http://w3c-test.org/IndexedDB/interfaces.worker 0 passes -&gt; 145 passes (out of 156)

Tests: fast/workers/self-hasOwnProperty.html
       fast/workers/self-toString.html

* bindings/js/JSWorkerGlobalScopeBase.cpp:
(WebCore::JSWorkerGlobalScopeBase::finishCreation):
(WebCore::JSWorkerGlobalScopeBase::visitChildren):
(WebCore::toJS):
* bindings/js/JSWorkerGlobalScopeBase.h:
(WebCore::JSWorkerGlobalScopeBase::proxy):
* bindings/js/WorkerScriptController.cpp:
(WebCore::WorkerScriptController::initScript):
* bindings/scripts/CodeGeneratorJS.pm:
(GenerateHeader):
(GenerateImplementation):

LayoutTests:

Add tests to make sure that self.toString() and self.hasOwnProperty()
now work in workers.

* fast/workers/self-hasOwnProperty-expected.txt: Added.
* fast/workers/self-hasOwnProperty.html: Added.
* fast/workers/self-toString-expected.txt: Added.
* fast/workers/self-toString.html: Added.</pre>

<h3>Modified Paths</h3>
<ul>
<li><a href="#trunkLayoutTestsChangeLog">trunk/LayoutTests/ChangeLog</a></li>
<li><a href="#trunkSourceJavaScriptCoreChangeLog">trunk/Source/JavaScriptCore/ChangeLog</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSProxyh">trunk/Source/JavaScriptCore/runtime/JSProxy.h</a></li>
<li><a href="#trunkSourceWebCoreChangeLog">trunk/Source/WebCore/ChangeLog</a></li>
<li><a href="#trunkSourceWebCorebindingsjsJSWorkerGlobalScopeBasecpp">trunk/Source/WebCore/bindings/js/JSWorkerGlobalScopeBase.cpp</a></li>
<li><a href="#trunkSourceWebCorebindingsjsJSWorkerGlobalScopeBaseh">trunk/Source/WebCore/bindings/js/JSWorkerGlobalScopeBase.h</a></li>
<li><a href="#trunkSourceWebCorebindingsjsWorkerScriptControllercpp">trunk/Source/WebCore/bindings/js/WorkerScriptController.cpp</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptsCodeGeneratorJSpm">trunk/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm</a></li>
</ul>

<h3>Added Paths</h3>
<ul>
<li><a href="#trunkLayoutTestsfastworkersselfhasOwnPropertyexpectedtxt">trunk/LayoutTests/fast/workers/self-hasOwnProperty-expected.txt</a></li>
<li><a href="#trunkLayoutTestsfastworkersselfhasOwnPropertyhtml">trunk/LayoutTests/fast/workers/self-hasOwnProperty.html</a></li>
<li><a href="#trunkLayoutTestsfastworkersselftoStringexpectedtxt">trunk/LayoutTests/fast/workers/self-toString-expected.txt</a></li>
<li><a href="#trunkLayoutTestsfastworkersselftoStringhtml">trunk/LayoutTests/fast/workers/self-toString.html</a></li>
</ul>

</div>
<div id="patch">
<h3>Diff</h3>
<a id="trunkLayoutTestsChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/LayoutTests/ChangeLog (201807 => 201808)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/ChangeLog        2016-06-08 17:21:52 UTC (rev 201807)
+++ trunk/LayoutTests/ChangeLog        2016-06-08 17:31:12 UTC (rev 201808)
</span><span class="lines">@@ -1,3 +1,19 @@
</span><ins>+2016-06-08  Chris Dumez  &lt;cdumez@apple.com&gt;
+
+        self.hasOwnProperty() does not work inside Web workers
+        https://bugs.webkit.org/show_bug.cgi?id=158446
+        &lt;rdar://problem/26638397&gt;
+
+        Reviewed by Geoffrey Garen.
+
+        Add tests to make sure that self.toString() and self.hasOwnProperty()
+        now work in workers.
+
+        * fast/workers/self-hasOwnProperty-expected.txt: Added.
+        * fast/workers/self-hasOwnProperty.html: Added.
+        * fast/workers/self-toString-expected.txt: Added.
+        * fast/workers/self-toString.html: Added.
+
</ins><span class="cx"> 2016-06-06  Antti Koivisto  &lt;antti@apple.com&gt;
</span><span class="cx"> 
</span><span class="cx">         WebKit memory cache doesn't respect Vary header
</span></span></pre></div>
<a id="trunkLayoutTestsfastworkersselfhasOwnPropertyexpectedtxt"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/fast/workers/self-hasOwnProperty-expected.txt (0 => 201808)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/fast/workers/self-hasOwnProperty-expected.txt                                (rev 0)
+++ trunk/LayoutTests/fast/workers/self-hasOwnProperty-expected.txt        2016-06-08 17:31:12 UTC (rev 201808)
</span><span class="lines">@@ -0,0 +1,12 @@
</span><ins>+Tests that self.hasOwnProperty() works in workers
+
+On success, you will see a series of &quot;PASS&quot; messages, followed by &quot;TEST COMPLETE&quot;.
+
+
+self.hasOwnProperty('DedicatedWorkerGlobalScope'): true
+self.hasOwnProperty('WorkerGlobalScope'): true
+self.hasOwnProperty('navigator'): true
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
</ins></span></pre></div>
<a id="trunkLayoutTestsfastworkersselfhasOwnPropertyhtml"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/fast/workers/self-hasOwnProperty.html (0 => 201808)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/fast/workers/self-hasOwnProperty.html                                (rev 0)
+++ trunk/LayoutTests/fast/workers/self-hasOwnProperty.html        2016-06-08 17:31:12 UTC (rev 201808)
</span><span class="lines">@@ -0,0 +1,24 @@
</span><ins>+&lt;!DOCTYPE html&gt;
+&lt;script src=&quot;../../resources/js-test-pre.js&quot;&gt;&lt;/script&gt;
+&lt;script src=&quot;resources/worker-create-common.js&quot;&gt;&lt;/script&gt;
+&lt;script&gt;
+
+var jsTestIsAsync = true;
+
+description('Tests that self.hasOwnProperty() works in workers');
+
+var worker = createWorker();
+worker.postMessage(&quot;eval self.hasOwnProperty('DedicatedWorkerGlobalScope')&quot;);
+worker.postMessage(&quot;eval self.hasOwnProperty('WorkerGlobalScope')&quot;);
+worker.postMessage(&quot;eval self.hasOwnProperty('navigator')&quot;);
+worker.postMessage(&quot;eval DONE&quot;);
+
+worker.onmessage = function(evt) {
+    if (!/DONE/.test(evt.data))
+        debug(evt.data.replace(new RegExp(&quot;/.*LayoutTests&quot;), &quot;&lt;...&gt;&quot;));
+    else
+        finishJSTest();
+};
+
+&lt;/script&gt;
+&lt;script src=&quot;../../resources/js-test-post.js&quot;&gt;&lt;/script&gt;
</ins></span></pre></div>
<a id="trunkLayoutTestsfastworkersselftoStringexpectedtxt"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/fast/workers/self-toString-expected.txt (0 => 201808)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/fast/workers/self-toString-expected.txt                                (rev 0)
+++ trunk/LayoutTests/fast/workers/self-toString-expected.txt        2016-06-08 17:31:12 UTC (rev 201808)
</span><span class="lines">@@ -0,0 +1,11 @@
</span><ins>+Tests that self.toString() works in workers
+
+On success, you will see a series of &quot;PASS&quot; messages, followed by &quot;TEST COMPLETE&quot;.
+
+
+self.toString(): [object DedicatedWorkerGlobalScope]
+'self: ' + self: self: [object DedicatedWorkerGlobalScope]
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
</ins></span></pre></div>
<a id="trunkLayoutTestsfastworkersselftoStringhtml"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/fast/workers/self-toString.html (0 => 201808)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/fast/workers/self-toString.html                                (rev 0)
+++ trunk/LayoutTests/fast/workers/self-toString.html        2016-06-08 17:31:12 UTC (rev 201808)
</span><span class="lines">@@ -0,0 +1,23 @@
</span><ins>+&lt;!DOCTYPE html&gt;
+&lt;script src=&quot;../../resources/js-test-pre.js&quot;&gt;&lt;/script&gt;
+&lt;script src=&quot;resources/worker-create-common.js&quot;&gt;&lt;/script&gt;
+&lt;script&gt;
+
+var jsTestIsAsync = true;
+
+description('Tests that self.toString() works in workers');
+
+var worker = createWorker();
+worker.postMessage(&quot;eval self.toString()&quot;);
+worker.postMessage(&quot;eval 'self: ' + self&quot;);
+worker.postMessage(&quot;eval DONE&quot;);
+
+worker.onmessage = function(evt) {
+    if (!/DONE/.test(evt.data))
+        debug(evt.data.replace(new RegExp(&quot;/.*LayoutTests&quot;), &quot;&lt;...&gt;&quot;));
+    else
+        finishJSTest();
+};
+
+&lt;/script&gt;
+&lt;script src=&quot;../../resources/js-test-post.js&quot;&gt;&lt;/script&gt;
</ins></span></pre></div>
<a id="trunkSourceJavaScriptCoreChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/ChangeLog (201807 => 201808)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/ChangeLog        2016-06-08 17:21:52 UTC (rev 201807)
+++ trunk/Source/JavaScriptCore/ChangeLog        2016-06-08 17:31:12 UTC (rev 201808)
</span><span class="lines">@@ -1,3 +1,20 @@
</span><ins>+2016-06-08  Chris Dumez  &lt;cdumez@apple.com&gt;
+
+        self.hasOwnProperty() does not work inside Web workers
+        https://bugs.webkit.org/show_bug.cgi?id=158446
+        &lt;rdar://problem/26638397&gt;
+
+        Reviewed by Geoffrey Garen.
+
+        Add a factory function to JSProxy to create a JSProxy without a target.
+        Also make the setTarget() method public so that the target can now be
+        set after creation. This is needed so that we can create a proxy for
+        JSWorkerGlobalScope, then create the JSWorkerGlobalScope object,
+        passing it the proxy and finally set the target on the proxy.
+
+        * runtime/JSProxy.h:
+        (JSC::JSProxy::create):
+
</ins><span class="cx"> 2016-06-07  Filip Pizlo  &lt;fpizlo@apple.com&gt;
</span><span class="cx"> 
</span><span class="cx">         Add result validation to JSAir
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSProxyh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSProxy.h (201807 => 201808)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSProxy.h        2016-06-08 17:21:52 UTC (rev 201807)
+++ trunk/Source/JavaScriptCore/runtime/JSProxy.h        2016-06-08 17:31:12 UTC (rev 201808)
</span><span class="lines">@@ -42,6 +42,13 @@
</span><span class="cx">         return proxy;
</span><span class="cx">     }
</span><span class="cx"> 
</span><ins>+    static JSProxy* create(VM&amp; vm, Structure* structure)
+    {
+        JSProxy* proxy = new (NotNull, allocateCell&lt;JSProxy&gt;(vm.heap)) JSProxy(vm, structure);
+        proxy-&gt;finishCreation(vm);
+        return proxy;
+    }
+
</ins><span class="cx">     static Structure* createStructure(VM&amp; vm, JSGlobalObject* globalObject, JSValue prototype, JSType proxyType)
</span><span class="cx">     {
</span><span class="cx">         ASSERT(proxyType == ImpureProxyType || proxyType == PureForwardingProxyType);
</span><span class="lines">@@ -53,6 +60,8 @@
</span><span class="cx">     JSObject* target() const { return m_target.get(); }
</span><span class="cx">     static ptrdiff_t targetOffset() { return OBJECT_OFFSETOF(JSProxy, m_target); }
</span><span class="cx"> 
</span><ins>+    JS_EXPORT_PRIVATE void setTarget(VM&amp;, JSGlobalObject*);
+
</ins><span class="cx"> protected:
</span><span class="cx">     JSProxy(VM&amp; vm, Structure* structure)
</span><span class="cx">         : JSDestructibleObject(vm, structure)
</span><span class="lines">@@ -72,8 +81,6 @@
</span><span class="cx"> 
</span><span class="cx">     JS_EXPORT_PRIVATE static void visitChildren(JSCell*, SlotVisitor&amp;);
</span><span class="cx"> 
</span><del>-    JS_EXPORT_PRIVATE void setTarget(VM&amp;, JSGlobalObject*);
-
</del><span class="cx">     JS_EXPORT_PRIVATE static String className(const JSObject*);
</span><span class="cx">     JS_EXPORT_PRIVATE static bool getOwnPropertySlot(JSObject*, ExecState*, PropertyName, PropertySlot&amp;);
</span><span class="cx">     JS_EXPORT_PRIVATE static bool getOwnPropertySlotByIndex(JSObject*, ExecState*, unsigned, PropertySlot&amp;);
</span></span></pre></div>
<a id="trunkSourceWebCoreChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/ChangeLog (201807 => 201808)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/ChangeLog        2016-06-08 17:21:52 UTC (rev 201807)
+++ trunk/Source/WebCore/ChangeLog        2016-06-08 17:31:12 UTC (rev 201808)
</span><span class="lines">@@ -1,3 +1,45 @@
</span><ins>+2016-06-08  Chris Dumez  &lt;cdumez@apple.com&gt;
+
+        self.hasOwnProperty() does not work inside Web workers
+        https://bugs.webkit.org/show_bug.cgi?id=158446
+        &lt;rdar://problem/26638397&gt;
+
+        Reviewed by Geoffrey Garen.
+
+        W3C tests for workers were severely broken on WebKit because
+        self.hasOwnProperty() did not work inside workers. The reason is that
+        hasOwnProperty() (and other methods like toString()) call toThis() in
+        StrictMode on thisValue. However, in the case of 'self' in workers,
+        self was a DedicatedWorkerGlobalScope, which is a JSGlobalObject.
+        JSGlobalObject::toThis() returns jsUndefined() when called in strict
+        mode. As a result, we would end up with exceptions such as &quot;undefined
+        is not an object&quot; when calling self.hasOwnProperty() in workers.
+
+        To address the problem, this patch introduces a JSProxy whose proxy
+        type is PureForwardingProxyType and whose target is the
+        WorkerGlobalScope. This JSProxy is what we expose to the JavaScript,
+        instead of the JSWorkerGlobalScope itself. As a result, toThis() now
+        behaves as expected and self.hasOwnProperty() works inside workers.
+
+        This patch greatly improves our pass rate on several W3C tests:
+        http://w3c-test.org/workers/interfaces.worker: 20 passes -&gt; 50 passes (out of 128)
+        http://w3c-test.org/IndexedDB/interfaces.worker 0 passes -&gt; 145 passes (out of 156)
+
+        Tests: fast/workers/self-hasOwnProperty.html
+               fast/workers/self-toString.html
+
+        * bindings/js/JSWorkerGlobalScopeBase.cpp:
+        (WebCore::JSWorkerGlobalScopeBase::finishCreation):
+        (WebCore::JSWorkerGlobalScopeBase::visitChildren):
+        (WebCore::toJS):
+        * bindings/js/JSWorkerGlobalScopeBase.h:
+        (WebCore::JSWorkerGlobalScopeBase::proxy):
+        * bindings/js/WorkerScriptController.cpp:
+        (WebCore::WorkerScriptController::initScript):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        (GenerateHeader):
+        (GenerateImplementation):
+
</ins><span class="cx"> 2016-06-08  Antti Koivisto  &lt;antti@apple.com&gt;
</span><span class="cx"> 
</span><span class="cx">         WebKit memory cache doesn't respect Vary header
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsjsJSWorkerGlobalScopeBasecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/js/JSWorkerGlobalScopeBase.cpp (201807 => 201808)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/js/JSWorkerGlobalScopeBase.cpp        2016-06-08 17:21:52 UTC (rev 201807)
+++ trunk/Source/WebCore/bindings/js/JSWorkerGlobalScopeBase.cpp        2016-06-08 17:31:12 UTC (rev 201808)
</span><span class="lines">@@ -35,6 +35,7 @@
</span><span class="cx"> #include &quot;JSWorkerGlobalScope.h&quot;
</span><span class="cx"> #include &quot;Language.h&quot;
</span><span class="cx"> #include &quot;WorkerGlobalScope.h&quot;
</span><ins>+#include &lt;runtime/JSCInlines.h&gt;
</ins><span class="cx"> #include &lt;runtime/JSCJSValueInlines.h&gt;
</span><span class="cx"> #include &lt;runtime/Microtask.h&gt;
</span><span class="cx"> 
</span><span class="lines">@@ -52,12 +53,22 @@
</span><span class="cx"> {
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-void JSWorkerGlobalScopeBase::finishCreation(VM&amp; vm)
</del><ins>+void JSWorkerGlobalScopeBase::finishCreation(VM&amp; vm, JSProxy* proxy)
</ins><span class="cx"> {
</span><del>-    Base::finishCreation(vm);
</del><ins>+    m_proxy.set(vm, this, proxy);
+
+    Base::finishCreation(vm, m_proxy.get());
</ins><span class="cx">     ASSERT(inherits(info()));
</span><span class="cx"> }
</span><span class="cx"> 
</span><ins>+void JSWorkerGlobalScopeBase::visitChildren(JSCell* cell, SlotVisitor&amp; visitor)
+{
+    JSWorkerGlobalScopeBase* thisObject = jsCast&lt;JSWorkerGlobalScopeBase*&gt;(cell);
+    ASSERT_GC_OBJECT_INHERITS(thisObject, info());
+    Base::visitChildren(thisObject, visitor);
+    visitor.append(&amp;thisObject-&gt;m_proxy);
+}
+
</ins><span class="cx"> void JSWorkerGlobalScopeBase::destroy(JSCell* cell)
</span><span class="cx"> {
</span><span class="cx">     static_cast&lt;JSWorkerGlobalScopeBase*&gt;(cell)-&gt;JSWorkerGlobalScopeBase::~JSWorkerGlobalScopeBase();
</span><span class="lines">@@ -111,7 +122,7 @@
</span><span class="cx">         return jsNull();
</span><span class="cx">     JSWorkerGlobalScope* contextWrapper = script-&gt;workerGlobalScopeWrapper();
</span><span class="cx">     ASSERT(contextWrapper);
</span><del>-    return contextWrapper;
</del><ins>+    return contextWrapper-&gt;proxy();
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> JSDedicatedWorkerGlobalScope* toJSDedicatedWorkerGlobalScope(JSValue value)
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsjsJSWorkerGlobalScopeBaseh"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/js/JSWorkerGlobalScopeBase.h (201807 => 201808)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/js/JSWorkerGlobalScopeBase.h        2016-06-08 17:21:52 UTC (rev 201807)
+++ trunk/Source/WebCore/bindings/js/JSWorkerGlobalScopeBase.h        2016-06-08 17:31:12 UTC (rev 201808)
</span><span class="lines">@@ -43,6 +43,7 @@
</span><span class="cx">         DECLARE_INFO;
</span><span class="cx"> 
</span><span class="cx">         WorkerGlobalScope&amp; wrapped() const { return *m_wrapped; }
</span><ins>+        JSC::JSProxy* proxy() const { ASSERT(m_proxy); return m_proxy.get(); }
</ins><span class="cx">         ScriptExecutionContext* scriptExecutionContext() const;
</span><span class="cx"> 
</span><span class="cx">         static JSC::Structure* createStructure(JSC::VM&amp; vm, JSC::JSGlobalObject* globalObject, JSC::JSValue prototype)
</span><span class="lines">@@ -61,10 +62,13 @@
</span><span class="cx"> 
</span><span class="cx">     protected:
</span><span class="cx">         JSWorkerGlobalScopeBase(JSC::VM&amp;, JSC::Structure*, RefPtr&lt;WorkerGlobalScope&gt;&amp;&amp;);
</span><del>-        void finishCreation(JSC::VM&amp;);
</del><ins>+        void finishCreation(JSC::VM&amp;, JSC::JSProxy*);
</ins><span class="cx"> 
</span><ins>+        static void visitChildren(JSC::JSCell*, JSC::SlotVisitor&amp;);
+
</ins><span class="cx">     private:
</span><span class="cx">         RefPtr&lt;WorkerGlobalScope&gt; m_wrapped;
</span><ins>+        JSC::WriteBarrier&lt;JSC::JSProxy&gt; m_proxy;
</ins><span class="cx">     };
</span><span class="cx"> 
</span><span class="cx">     // Returns a JSWorkerGlobalScope or jsNull()
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsjsWorkerScriptControllercpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/js/WorkerScriptController.cpp (201807 => 201808)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/js/WorkerScriptController.cpp        2016-06-08 17:21:52 UTC (rev 201807)
+++ trunk/Source/WebCore/bindings/js/WorkerScriptController.cpp        2016-06-08 17:31:12 UTC (rev 201808)
</span><span class="lines">@@ -88,8 +88,10 @@
</span><span class="cx">         Structure* dedicatedContextPrototypeStructure = JSDedicatedWorkerGlobalScopePrototype::createStructure(*m_vm, 0, workerGlobalScopePrototype.get());
</span><span class="cx">         Strong&lt;JSDedicatedWorkerGlobalScopePrototype&gt; dedicatedContextPrototype(*m_vm, JSDedicatedWorkerGlobalScopePrototype::create(*m_vm, 0, dedicatedContextPrototypeStructure));
</span><span class="cx">         Structure* structure = JSDedicatedWorkerGlobalScope::createStructure(*m_vm, 0, dedicatedContextPrototype.get());
</span><ins>+        auto* proxyStructure = JSProxy::createStructure(*m_vm, nullptr, jsNull(), PureForwardingProxyType);
+        auto* proxy = JSProxy::create(*m_vm, proxyStructure);
</ins><span class="cx"> 
</span><del>-        m_workerGlobalScopeWrapper.set(*m_vm, JSDedicatedWorkerGlobalScope::create(*m_vm, structure, static_cast&lt;DedicatedWorkerGlobalScope&amp;&gt;(*m_workerGlobalScope)));
</del><ins>+        m_workerGlobalScopeWrapper.set(*m_vm, JSDedicatedWorkerGlobalScope::create(*m_vm, structure, static_cast&lt;DedicatedWorkerGlobalScope&amp;&gt;(*m_workerGlobalScope), proxy));
</ins><span class="cx">         workerGlobalScopePrototypeStructure-&gt;setGlobalObject(*m_vm, m_workerGlobalScopeWrapper.get());
</span><span class="cx">         dedicatedContextPrototypeStructure-&gt;setGlobalObject(*m_vm, m_workerGlobalScopeWrapper.get());
</span><span class="cx">         ASSERT(structure-&gt;globalObject() == m_workerGlobalScopeWrapper);
</span><span class="lines">@@ -97,6 +99,9 @@
</span><span class="cx">         workerGlobalScopePrototype-&gt;structure()-&gt;setGlobalObject(*m_vm, m_workerGlobalScopeWrapper.get());
</span><span class="cx">         workerGlobalScopePrototype-&gt;structure()-&gt;setPrototypeWithoutTransition(*m_vm, JSEventTarget::prototype(*m_vm, m_workerGlobalScopeWrapper.get()));
</span><span class="cx">         dedicatedContextPrototype-&gt;structure()-&gt;setGlobalObject(*m_vm, m_workerGlobalScopeWrapper.get());
</span><ins>+
+        proxy-&gt;setTarget(*m_vm, m_workerGlobalScopeWrapper.get());
+        proxy-&gt;structure()-&gt;setGlobalObject(*m_vm, m_workerGlobalScopeWrapper.get());
</ins><span class="cx">     }
</span><span class="cx">     ASSERT(m_workerGlobalScopeWrapper-&gt;globalObject() == m_workerGlobalScopeWrapper);
</span><span class="cx">     ASSERT(asObject(m_workerGlobalScopeWrapper-&gt;getPrototypeDirect())-&gt;globalObject() == m_workerGlobalScopeWrapper);
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptsCodeGeneratorJSpm"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm (201807 => 201808)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm        2016-06-08 17:21:52 UTC (rev 201807)
+++ trunk/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm        2016-06-08 17:31:12 UTC (rev 201808)
</span><span class="lines">@@ -1101,10 +1101,10 @@
</span><span class="cx">         push(@headerContent, &quot;        return ptr;\n&quot;);
</span><span class="cx">         push(@headerContent, &quot;    }\n\n&quot;);
</span><span class="cx">     } elsif ($codeGenerator-&gt;InheritsInterface($interface, &quot;WorkerGlobalScope&quot;)) {
</span><del>-        push(@headerContent, &quot;    static $className* create(JSC::VM&amp; vm, JSC::Structure* structure, Ref&lt;$implType&gt;&amp;&amp; impl)\n&quot;);
</del><ins>+        push(@headerContent, &quot;    static $className* create(JSC::VM&amp; vm, JSC::Structure* structure, Ref&lt;$implType&gt;&amp;&amp; impl, JSC::JSProxy* proxy)\n&quot;);
</ins><span class="cx">         push(@headerContent, &quot;    {\n&quot;);
</span><span class="cx">         push(@headerContent, &quot;        $className* ptr = new (NotNull, JSC::allocateCell&lt;$className&gt;(vm.heap)) ${className}(vm, structure, WTFMove(impl));\n&quot;);
</span><del>-        push(@headerContent, &quot;        ptr-&gt;finishCreation(vm);\n&quot;);
</del><ins>+        push(@headerContent, &quot;        ptr-&gt;finishCreation(vm, proxy);\n&quot;);
</ins><span class="cx">         push(@headerContent, &quot;        vm.heap.addFinalizer(ptr, destroy);\n&quot;);
</span><span class="cx">         push(@headerContent, &quot;        return ptr;\n&quot;);
</span><span class="cx">         push(@headerContent, &quot;    }\n\n&quot;);
</span><span class="lines">@@ -1416,7 +1416,7 @@
</span><span class="cx">         if ($interfaceName eq &quot;DOMWindow&quot;) {
</span><span class="cx">             push(@headerContent, &quot;    void finishCreation(JSC::VM&amp;, JSDOMWindowShell*);\n&quot;);
</span><span class="cx">         } else {
</span><del>-            push(@headerContent, &quot;    void finishCreation(JSC::VM&amp;);\n&quot;);
</del><ins>+            push(@headerContent, &quot;    void finishCreation(JSC::VM&amp;, JSC::JSProxy*);\n&quot;);
</ins><span class="cx">         }
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="lines">@@ -2359,9 +2359,9 @@
</span><span class="cx">             push(@implContent, &quot;{\n&quot;);
</span><span class="cx">             push(@implContent, &quot;    Base::finishCreation(vm, shell);\n\n&quot;);
</span><span class="cx">         } else {
</span><del>-            push(@implContent, &quot;void ${className}::finishCreation(VM&amp; vm)\n&quot;);
</del><ins>+            push(@implContent, &quot;void ${className}::finishCreation(VM&amp; vm, JSProxy* proxy)\n&quot;);
</ins><span class="cx">             push(@implContent, &quot;{\n&quot;);
</span><del>-            push(@implContent, &quot;    Base::finishCreation(vm);\n\n&quot;);
</del><ins>+            push(@implContent, &quot;    Base::finishCreation(vm, proxy);\n\n&quot;);
</ins><span class="cx">         }
</span><span class="cx">         # Support for RuntimeEnabled attributes on global objects.
</span><span class="cx">         foreach my $attribute (@{$interface-&gt;attributes}) {
</span></span></pre>
</div>
</div>

</body>
</html>