javascript - 有什么方法可以拦截 v8 上下文的全局对象中的函数定义吗？

Question

我正在尝试清除 v8::Context稍后重用它(创建新的除外)以获得更好的性能。

我已经用 write/enum/configure 保护了所有内置函数标志设置为 false .运行任何脚本后，我试图迭代所有 configurable Context.Global 中的属性并删除它们。

主要问题是 Script::Run将脚本中的所有函数定义为 configurable: false v8::Context 中的属性, 所以它不能被 Global->Delete(...) 删除

我尝试设置一个 Interceptor在 Global对象，但它没有帮助(GenericNamedPropertyDefinerCallback 没有在 Script::Run 之后调用)

代码示例:

#include <v8.h>
#include <libplatform/libplatform.h>
#include <iostream>
#include <iomanip>

#define trace(s) std::cout << s << std::endl
#define traceh(s) trace("===== " << std::setw(64) << s << " =====")

const char* _script = "function test_func() { return \"something\"; }";

std::string getString(const v8::Local<v8::Value>& value) {
    auto* pIsolate = v8::Isolate::GetCurrent();
    return *v8::String::Utf8Value(pIsolate, value);
}

v8::Local<v8::UnboundScript> compileScript(const char* script) {
    auto* pIsolate = v8::Isolate::GetCurrent();
    v8::EscapableHandleScope hScope(pIsolate);

    auto source_str = v8::String::NewFromUtf8(pIsolate, script);
    v8::ScriptCompiler::Source source(source_str);
    v8::TryCatch TryCatch(pIsolate);
    auto mScript = v8::ScriptCompiler::CompileUnboundScript(pIsolate, &source);
    if (mScript.IsEmpty()) {
        trace("failed to compile script: " << getString(TryCatch.Exception()));
        return {};
    }
    return hScope.Escape(mScript.ToLocalChecked());
}

void protectContext(v8::Local<v8::Context>& context) {
    traceh("protecting context");
    auto* pIsolate = v8::Isolate::GetCurrent();
    v8::HandleScope hScope(pIsolate);
    auto Global = context->Global();
    auto mPropNames = Global->GetPropertyNames(context, v8::KeyCollectionMode::kIncludePrototypes,
                                               v8::PropertyFilter::ALL_PROPERTIES, v8::IndexFilter::kSkipIndices);
    if (mPropNames.IsEmpty()) {
        trace("failed to get property names of global object");
        return;
    }
    auto propNames = mPropNames.ToLocalChecked();
    for (uint32_t i = 0; i < propNames->Length(); ++i) {
        auto keyVal = propNames->Get(context, i).ToLocalChecked();
        auto key = v8::Local<v8::Name>::Cast(keyVal);
        auto prev_attribs = Global->GetPropertyAttributes(context, key).ToChecked();
        auto val = Global->Get(context, key).ToLocalChecked();
        v8::PropertyDescriptor descriptor(val, false);
        descriptor.set_enumerable(false);
        descriptor.set_configurable(false);
        v8::TryCatch TryCatch(pIsolate);
        auto mResult = Global->DefineProperty(context, key, descriptor);
        if (mResult.IsNothing()) {
            trace("failed to protect property: " << getString(TryCatch.Exception()));
        }
        auto lResult = !mResult.IsNothing() && mResult.ToChecked();
        auto attribs = Global->GetPropertyAttributes(context, key).ToChecked();
        trace("protected: " << std::setw(31) << getString(key) << " - " << (lResult ? "ok" : "fl") <<
              "; prev-attribs=" << std::setw(2) << prev_attribs <<
              "; attribs=" << std::setw(2) << attribs);
    }
}

void clearContext(v8::Local<v8::Context>& context) {
    traceh("clearing context");
    auto* pIsolate = v8::Isolate::GetCurrent();
    v8::HandleScope hScope(pIsolate);
    auto Global = context->Global();
    auto mPropNames = Global->GetPropertyNames(context, v8::KeyCollectionMode::kIncludePrototypes,
                                               v8::PropertyFilter::ALL_PROPERTIES, v8::IndexFilter::kSkipIndices);
    if (mPropNames.IsEmpty()) {
        trace("failed to get property names of global object");
        return;
    }
    auto propNames = mPropNames.ToLocalChecked();
    for (uint32_t i = 0; i < propNames->Length(); ++i) {
        auto key = propNames->Get(context, i).ToLocalChecked();
        auto attribs = Global->GetPropertyAttributes(context, key).ToChecked();
        v8::TryCatch TryCatch(pIsolate);
        auto mResult = Global->Delete(context, key);
        if (TryCatch.HasCaught()) {
            trace("failed to delete property: " << getString(TryCatch.Exception()));
        }
        auto lResult = !mResult.IsNothing() && mResult.ToChecked();
        trace("deleted: " << std::setw(33) << getString(key) << " - " << (lResult ? "ok" : "fl") <<
              "; prev-attribs=" << std::setw(2) << attribs);
    }
}

int main() {
    v8::V8::InitializeICU();
    auto platform_ptr = v8::platform::NewDefaultPlatform();
    v8::V8::InitializePlatform(platform_ptr.get());
    v8::V8::Initialize();

    v8::Isolate::CreateParams create_params;
    create_params.array_buffer_allocator = v8::ArrayBuffer::Allocator::NewDefaultAllocator();
    auto* pIsolate = v8::Isolate::New(create_params);
    {
        v8::Isolate::Scope iScope(pIsolate);
        {
            v8::HandleScope hScope(pIsolate);
            v8::Local<v8::UnboundScript> UnboundScript;
            {
                auto Context = v8::Context::New(pIsolate);
                {
                    v8::Context::Scope cScope(Context);
                    UnboundScript = compileScript(_script);
                }
            }
            {
                auto Context = v8::Context::New(pIsolate);
                {
                    v8::Context::Scope cScope(Context);

                    protectContext(Context);

                    auto Script = UnboundScript->BindToCurrentContext();
                    trace("Script::Run - " << (Script->Run(Context).IsEmpty() ? "fail" : "ok"));

                    clearContext(Context);
                }
            }
        }
    }
    pIsolate->Dispose();

    v8::V8::ShutdownPlatform();
    return 0;
}

在 v8-7.5(最新的 chrome-stable)下运行它之后，我得到了

deleted:                         test_func - fl; prev-attribs= 4

删除失败，因为 4 是 configure: false

Answer 1

我在你的代码中没有看到拦截器，但除此之外......

GenericNamedPropertyDefinerCallback 将在脚本使用 Object.defineProperty(global, name, ...) 时调用，而 name 不是数组索引。

我没有意识到常规的 function foo() {...} 定义也被安装为不可配置的 (TIL ☺)。要拦截它们，您需要另外两个拦截器:一个返回 true(表示“此属性已存在”)的 GenericNamedPropertyQueryCallback，以及一个 GenericNamedPropertySetterCallback，如果查询回调表示该属性存在，将调用它来“覆盖”它。请注意，您必须负责属性(property)的实际存储。或者您可以简单地阻止所有尝试在全局对象上设置属性，强制所有代码在 IIFE (function() {/* all code here */})() 中运行。想想看，也许在你的嵌入代码中应用这样的包装是实现你的目标的更简单的方法……我想除了 globalThis 之外。

为了完整性:如果您还想拦截整数索引的属性/函数，您将需要相应的索引拦截器(IndexedPropertySetterCallback 等)。

我通过查看 V8 的源代码将其拼凑在一起，但我自己还没有尝试过。如果它不起作用，请告诉我，如果是，请包含您的代码。