From cc13c896b8dc7438673d3030a24cfb26c50accb1 Mon Sep 17 00:00:00 2001
From: Jochen Eisinger <jochen@chromium.org>
Date: Fri, 15 Jul 2016 10:07:53 +0200
Subject: Remove prototypes from v8 functions that aren't constructors

BUG=chromium:625823
TBR=haraken@chromium.org,thestig@chromium.org

Review-Url: https://codereview.chromium.org/2123153002
(cherry picked from commit c4dedf32b1f5c71740df5be2a9b1446a01df304c)

Review URL: https://codereview.chromium.org/2148793006 .
---
 fpdfsdk/jsapi/fxjs_v8.cpp | 33 ++++++++++++++++++++-------------
 fxjse/class.cpp           | 26 +++++++++++++++-----------
 2 files changed, 35 insertions(+), 24 deletions(-)

diff --git a/fpdfsdk/jsapi/fxjs_v8.cpp b/fpdfsdk/jsapi/fxjs_v8.cpp
index 283fac978a..3297b4bd12 100644
--- a/fpdfsdk/jsapi/fxjs_v8.cpp
+++ b/fpdfsdk/jsapi/fxjs_v8.cpp
@@ -243,13 +243,14 @@ void FXJS_DefineObjMethod(v8::Isolate* pIsolate,
   CFX_ByteString bsMethodName = CFX_WideString(sMethodName).UTF8Encode();
   CFXJS_ObjDefinition* pObjDef =
       CFXJS_ObjDefinition::ForID(pIsolate, nObjDefnID);
+  v8::Local<v8::FunctionTemplate> fun = v8::FunctionTemplate::New(
+      pIsolate, pMethodCall, v8::Local<v8::Value>(), pObjDef->GetSignature());
+  fun->RemovePrototype();
   pObjDef->GetInstanceTemplate()->Set(
       v8::String::NewFromUtf8(pIsolate, bsMethodName.c_str(),
                               v8::NewStringType::kNormal)
           .ToLocalChecked(),
-      v8::FunctionTemplate::New(pIsolate, pMethodCall, v8::Local<v8::Value>(),
-                                pObjDef->GetSignature()),
-      v8::ReadOnly);
+      fun, v8::ReadOnly);
 }
 
 void FXJS_DefineObjProperty(v8::Isolate* pIsolate,
@@ -301,11 +302,14 @@ void FXJS_DefineGlobalMethod(v8::Isolate* pIsolate,
   v8::Isolate::Scope isolate_scope(pIsolate);
   v8::HandleScope handle_scope(pIsolate);
   CFX_ByteString bsMethodName = CFX_WideString(sMethodName).UTF8Encode();
-  GetGlobalObjectTemplate(pIsolate)
-      ->Set(v8::String::NewFromUtf8(pIsolate, bsMethodName.c_str(),
-                                    v8::NewStringType::kNormal)
-                .ToLocalChecked(),
-            v8::FunctionTemplate::New(pIsolate, pMethodCall), v8::ReadOnly);
+  v8::Local<v8::FunctionTemplate> fun =
+      v8::FunctionTemplate::New(pIsolate, pMethodCall);
+  fun->RemovePrototype();
+  GetGlobalObjectTemplate(pIsolate)->Set(
+      v8::String::NewFromUtf8(pIsolate, bsMethodName.c_str(),
+                              v8::NewStringType::kNormal)
+          .ToLocalChecked(),
+      fun, v8::ReadOnly);
 }
 
 void FXJS_DefineGlobalConst(v8::Isolate* pIsolate,
@@ -314,11 +318,14 @@ void FXJS_DefineGlobalConst(v8::Isolate* pIsolate,
   v8::Isolate::Scope isolate_scope(pIsolate);
   v8::HandleScope handle_scope(pIsolate);
   CFX_ByteString bsConst = CFX_WideString(sConstName).UTF8Encode();
-  GetGlobalObjectTemplate(pIsolate)
-      ->SetAccessorProperty(v8::String::NewFromUtf8(pIsolate, bsConst.c_str(),
-                                                    v8::NewStringType::kNormal)
-                                .ToLocalChecked(),
-                            v8::FunctionTemplate::New(pIsolate, pConstGetter));
+  v8::Local<v8::FunctionTemplate> fun =
+      v8::FunctionTemplate::New(pIsolate, pConstGetter);
+  fun->RemovePrototype();
+  GetGlobalObjectTemplate(pIsolate)->SetAccessorProperty(
+      v8::String::NewFromUtf8(pIsolate, bsConst.c_str(),
+                              v8::NewStringType::kNormal)
+          .ToLocalChecked(),
+      fun);
 }
 
 void FXJS_InitializeRuntime(
diff --git a/fxjse/class.cpp b/fxjse/class.cpp
index 1dba7f073f..a4ed0916bd 100644
--- a/fxjse/class.cpp
+++ b/fxjse/class.cpp
@@ -104,6 +104,9 @@ static void FXJSE_V8SetterCallback_Wrapper(
 
 static void FXJSE_V8ConstructorCallback_Wrapper(
     const v8::FunctionCallbackInfo<v8::Value>& info) {
+  if (!info.IsConstructCall()) {
+    return;
+  }
   const FXJSE_CLASS_DESCRIPTOR* lpClassDefinition =
       static_cast<FXJSE_CLASS_DESCRIPTOR*>(
           info.Data().As<v8::External>()->Value());
@@ -228,13 +231,14 @@ CFXJSE_Class* CFXJSE_Class::Create(
   }
   if (lpClassDefinition->methNum) {
     for (int32_t i = 0; i < lpClassDefinition->methNum; i++) {
+      v8::Local<v8::FunctionTemplate> fun = v8::FunctionTemplate::New(
+          pIsolate, FXJSE_V8FunctionCallback_Wrapper,
+          v8::External::New(pIsolate, const_cast<FXJSE_FUNCTION_DESCRIPTOR*>(
+                                          lpClassDefinition->methods + i)));
+      fun->RemovePrototype();
       hObjectTemplate->Set(
           v8::String::NewFromUtf8(pIsolate, lpClassDefinition->methods[i].name),
-          v8::FunctionTemplate::New(
-              pIsolate, FXJSE_V8FunctionCallback_Wrapper,
-              v8::External::New(pIsolate,
-                                const_cast<FXJSE_FUNCTION_DESCRIPTOR*>(
-                                    lpClassDefinition->methods + i))),
+          fun,
           static_cast<v8::PropertyAttribute>(v8::ReadOnly | v8::DontDelete));
     }
   }
@@ -260,12 +264,12 @@ CFXJSE_Class* CFXJSE_Class::Create(
     }
   }
   if (bIsJSGlobal) {
-    hObjectTemplate->Set(
-        v8::String::NewFromUtf8(pIsolate, "toString"),
-        v8::FunctionTemplate::New(
-            pIsolate, FXJSE_Context_GlobalObjToString,
-            v8::External::New(pIsolate, const_cast<FXJSE_CLASS_DESCRIPTOR*>(
-                                            lpClassDefinition))));
+    v8::Local<v8::FunctionTemplate> fun = v8::FunctionTemplate::New(
+        pIsolate, FXJSE_Context_GlobalObjToString,
+        v8::External::New(
+            pIsolate, const_cast<FXJSE_CLASS_DESCRIPTOR*>(lpClassDefinition)));
+    fun->RemovePrototype();
+    hObjectTemplate->Set(v8::String::NewFromUtf8(pIsolate, "toString"), fun);
   }
   pClass->m_hTemplate.Reset(lpContext->m_pIsolate, hFunctionTemplate);
   lpContext->m_rgClasses.push_back(std::unique_ptr<CFXJSE_Class>(pClass));
-- 
cgit v1.2.3