Workaround dubious casting between CXFA_Object and void* in FXJSE

This is just a crock to get things working until we fix the
underlying issue.

When there's single-inheritance, it may often work in practice
to C-style (reinterpret) cast a Derived* ptr to void* and then
back to a Base* ptr.  One place where this blows up is if
Derived has virtual functions but Base does not, in which case
the world will be offset by the size of a vtable ptr.

Because of the use of void* types in FXJSE, the above was happening
when setting a CXFA_ThisProxy (Derived, virtual) to be a global
object (void*). This would then be cast back to a CFXA_Object
(Base, non-virtual) and chaos is ensured.

Not sure how far back this goes.

Along the way, pick up some tidying which was necessary for
simplicity while tracking this down.

BUG=613607

Review-Url: https://codereview.chromium.org/2015143005

6 files changed, 52 insertions, 56 deletions

diff --git a/xfa/fxjse/class.cpp b/xfa/fxjse/class.cpp
index dcc370306a..d49bafb986 100644
--- a/xfa/fxjse/class.cpp
+++ b/xfa/fxjse/class.cpp
@@ -9,7 +9,6 @@
 #include "xfa/fxjse/cfxjse_arguments.h"
 #include "xfa/fxjse/context.h"
 #include "xfa/fxjse/scope_inline.h"
-#include "xfa/fxjse/util_inline.h"
 #include "xfa/fxjse/value.h"
 
 static void FXJSE_V8ConstructorCallback_Wrapper(
diff --git a/xfa/fxjse/context.cpp b/xfa/fxjse/context.cpp
index 333b2abe57..49d0b44338 100644
--- a/xfa/fxjse/context.cpp
+++ b/xfa/fxjse/context.cpp
@@ -8,9 +8,48 @@
 
 #include "xfa/fxjse/class.h"
 #include "xfa/fxjse/scope_inline.h"
-#include "xfa/fxjse/util_inline.h"
 #include "xfa/fxjse/value.h"
 
+v8::Local<v8::Object> FXJSE_GetGlobalObjectFromContext(
+    const v8::Local<v8::Context>& hContext) {
+  return hContext->Global()->GetPrototype().As<v8::Object>();
+}
+
+void FXJSE_UpdateObjectBinding(v8::Local<v8::Object>& hObject,
+                               void* lpNewBinding) {
+  ASSERT(!hObject.IsEmpty());
+  ASSERT(hObject->InternalFieldCount() > 0);
+  hObject->SetAlignedPointerInInternalField(0, lpNewBinding);
+}
+
+void* FXJSE_RetrieveObjectBinding(const v8::Local<v8::Object>& hJSObject,
+                                  CFXJSE_Class* lpClass) {
+  ASSERT(!hJSObject.IsEmpty());
+  if (!hJSObject->IsObject()) {
+    return NULL;
+  }
+  v8::Local<v8::Object> hObject = hJSObject;
+  if (hObject->InternalFieldCount() == 0) {
+    v8::Local<v8::Value> hProtoObject = hObject->GetPrototype();
+    if (hProtoObject.IsEmpty() || !hProtoObject->IsObject()) {
+      return NULL;
+    }
+    hObject = hProtoObject.As<v8::Object>();
+    if (hObject->InternalFieldCount() == 0) {
+      return NULL;
+    }
+  }
+  if (lpClass) {
+    v8::Local<v8::FunctionTemplate> hClass =
+        v8::Local<v8::FunctionTemplate>::New(
+            lpClass->GetContext()->GetRuntime(), lpClass->GetTemplate());
+    if (!hClass->HasInstance(hObject)) {
+      return NULL;
+    }
+  }
+  return hObject->GetAlignedPointerFromInternalField(0);
+}
+
 CFXJSE_Context* FXJSE_Context_Create(
     v8::Isolate* pIsolate,
     const FXJSE_CLASS_DESCRIPTOR* lpGlobalClass,
diff --git a/xfa/fxjse/context.h b/xfa/fxjse/context.h
index 96b93faffd..79e5e0a740 100644
--- a/xfa/fxjse/context.h
+++ b/xfa/fxjse/context.h
@@ -50,4 +50,13 @@ class CFXJSE_Context {
 v8::Local<v8::Object> FXJSE_CreateReturnValue(v8::Isolate* pIsolate,
                                               v8::TryCatch& trycatch);
 
+v8::Local<v8::Object> FXJSE_GetGlobalObjectFromContext(
+    const v8::Local<v8::Context>& hContext);
+
+void FXJSE_UpdateObjectBinding(v8::Local<v8::Object>& hObject,
+                               void* lpNewBinding = nullptr);
+
+void* FXJSE_RetrieveObjectBinding(const v8::Local<v8::Object>& hJSObject,
+                                  CFXJSE_Class* lpClass = nullptr);
+
 #endif  // XFA_FXJSE_CONTEXT_H_
diff --git a/xfa/fxjse/include/fxjse.h b/xfa/fxjse/include/fxjse.h
index d2d0bd9014..e278935657 100644
--- a/xfa/fxjse/include/fxjse.h
+++ b/xfa/fxjse/include/fxjse.h
@@ -72,8 +72,8 @@ void FXJSE_Runtime_Release(v8::Isolate* pIsolate, bool bOwnedRuntime);
 
 CFXJSE_Context* FXJSE_Context_Create(
     v8::Isolate* pIsolate,
-    const FXJSE_CLASS_DESCRIPTOR* lpGlobalClass = nullptr,
-    void* lpGlobalObject = nullptr);
+    const FXJSE_CLASS_DESCRIPTOR* lpGlobalClass,
+    void* lpGlobalObject);
 void FXJSE_Context_Release(CFXJSE_Context* pContext);
 CFXJSE_Value* FXJSE_Context_GetGlobalObject(CFXJSE_Context* pContext);
 
diff --git a/xfa/fxjse/util_inline.h b/xfa/fxjse/util_inline.h
deleted file mode 100644
index e61dc6aa80..0000000000
--- a/xfa/fxjse/util_inline.h
+++ /dev/null
@@ -1,51 +0,0 @@
-// Copyright 2014 PDFium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-// Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
-
-#ifndef XFA_FXJSE_UTIL_INLINE_H_
-#define XFA_FXJSE_UTIL_INLINE_H_
-
-#include "xfa/fxjse/context.h"
-
-static V8_INLINE v8::Local<v8::Object> FXJSE_GetGlobalObjectFromContext(
-    const v8::Local<v8::Context>& hContext) {
-  return hContext->Global()->GetPrototype().As<v8::Object>();
-}
-static V8_INLINE void FXJSE_UpdateObjectBinding(v8::Local<v8::Object>& hObject,
-                                                void* lpNewBinding) {
-  ASSERT(!hObject.IsEmpty());
-  ASSERT(hObject->InternalFieldCount() > 0);
-  hObject->SetAlignedPointerInInternalField(0, lpNewBinding);
-}
-static V8_INLINE void* FXJSE_RetrieveObjectBinding(
-    const v8::Local<v8::Object>& hJSObject,
-    CFXJSE_Class* lpClass = NULL) {
-  ASSERT(!hJSObject.IsEmpty());
-  if (!hJSObject->IsObject()) {
-    return NULL;
-  }
-  v8::Local<v8::Object> hObject = hJSObject;
-  if (hObject->InternalFieldCount() == 0) {
-    v8::Local<v8::Value> hProtoObject = hObject->GetPrototype();
-    if (hProtoObject.IsEmpty() || !hProtoObject->IsObject()) {
-      return NULL;
-    }
-    hObject = hProtoObject.As<v8::Object>();
-    if (hObject->InternalFieldCount() == 0) {
-      return NULL;
-    }
-  }
-  if (lpClass) {
-    v8::Local<v8::FunctionTemplate> hClass =
-        v8::Local<v8::FunctionTemplate>::New(
-            lpClass->GetContext()->GetRuntime(), lpClass->GetTemplate());
-    if (!hClass->HasInstance(hObject)) {
-      return NULL;
-    }
-  }
-  return hObject->GetAlignedPointerFromInternalField(0);
-}
-
-#endif  // XFA_FXJSE_UTIL_INLINE_H_
diff --git a/xfa/fxjse/value.cpp b/xfa/fxjse/value.cpp
index e7a3463f28..ecd88b078d 100644
--- a/xfa/fxjse/value.cpp
+++ b/xfa/fxjse/value.cpp
@@ -9,7 +9,7 @@
 #include <math.h>
 
 #include "xfa/fxjse/class.h"
-#include "xfa/fxjse/util_inline.h"
+#include "xfa/fxjse/context.h"
 
 FX_BOOL FXJSE_Value_IsUndefined(CFXJSE_Value* pValue) {
   return pValue && pValue->IsUndefined();