Workaround dubious casting between CXFA_Object and void* in FXJSE

This is just a crock to get things working until we fix the
underlying issue.

When there's single-inheritance, it may often work in practice
to C-style (reinterpret) cast a Derived* ptr to void* and then
back to a Base* ptr.  One place where this blows up is if
Derived has virtual functions but Base does not, in which case
the world will be offset by the size of a vtable ptr.

Because of the use of void* types in FXJSE, the above was happening
when setting a CXFA_ThisProxy (Derived, virtual) to be a global
object (void*). This would then be cast back to a CFXA_Object
(Base, non-virtual) and chaos is ensured.

Not sure how far back this goes.

Along the way, pick up some tidying which was necessary for
simplicity while tracking this down.

BUG=613607

Review-Url: https://codereview.chromium.org/2015143005

1 files changed, 9 insertions, 0 deletions

diff --git a/xfa/fxjse/context.h b/xfa/fxjse/context.h
index 96b93faffd..79e5e0a740 100644
--- a/xfa/fxjse/context.h
+++ b/xfa/fxjse/context.h
@@ -50,4 +50,13 @@ class CFXJSE_Context {
 v8::Local<v8::Object> FXJSE_CreateReturnValue(v8::Isolate* pIsolate,
                                               v8::TryCatch& trycatch);
 
+v8::Local<v8::Object> FXJSE_GetGlobalObjectFromContext(
+    const v8::Local<v8::Context>& hContext);
+
+void FXJSE_UpdateObjectBinding(v8::Local<v8::Object>& hObject,
+                               void* lpNewBinding = nullptr);
+
+void* FXJSE_RetrieveObjectBinding(const v8::Local<v8::Object>& hJSObject,
+                                  CFXJSE_Class* lpClass = nullptr);
+
 #endif  // XFA_FXJSE_CONTEXT_H_