commit 60cb383104586711e93c84a8b6ac804050e85270
author Yuki Shiino <yukishiino@chromium.org> Sat Sep 22 02:28:46 2018
committer Commit Bot <commit-bot@chromium.org> Sat Sep 22 02:28:46 2018
tree a5a17c30658cd73426abdcabe69bbc1d048edb86
parent c2778a08a604ca0acfb52e56b005f5cdbe5a924c

v8binding: Do not invoke FrameRequestCallback when iframe is detached.

Crash issue 887661 is happening because an iframe is detached, but
the iframe is still invoking FrameRequestCallback without performing
wrapper-tracing.

In the repro case, callback function's realm = the parent's one, and
the incumbent realm = the parent's one, however, the callback is
registered on the iframe that will be detached.  Thus, any check
against callback function's realm and the incumbent realm does not
work well in this case.

This patch fixes the crash issue by checking the execution context
on the call sites.

Bug: 887661
Change-Id: I1fa784add95424c9ff2c2b27ed3d2edbb920068e
Reviewed-on: https://chromium-review.googlesource.com/1237839
Reviewed-by: Hitoshi Yoshida <peria@chromium.org>
Reviewed-by: Kentaro Hara <haraken@chromium.org>
Commit-Queue: Yuki Shiino <yukishiino@chromium.org>
Cr-Commit-Position: refs/heads/master@{#593417}