有什么方法可以拦截 v8 上下文的全局对象中的函数定义吗？

Question

我正在尝试清除 v8::Context 以便稍后重用它（创建新的除外）以获得更好的性能。

我已将 write/enum/configure 标志设置为 false 来保护所有内置函数。在运行任何脚本之后，我试图遍历 Context.Global 中的所有 configurable 属性并删除它们。

主要问题是 Script::Run 将脚本中的所有函数定义为 v8::Context 中的 configurable: false 属性，因此无法通过 Global->Delete(...)[=25= 删除]

我已经尝试在 Global 对象上设置 Interceptor，但它没有帮助（GenericNamedPropertyDefinerCallback 没有在 Script::Run 之后调用）

代码示例：

#include <v8.h>
#include <libplatform/libplatform.h>
#include <iostream>
#include <iomanip>

#define trace(s) std::cout << s << std::endl
#define traceh(s) trace("===== " << std::setw(64) << s << " =====")

const char* _script = "function test_func() { return \"something\"; }";

std::string getString(const v8::Local<v8::Value>& value) {
    auto* pIsolate = v8::Isolate::GetCurrent();
    return *v8::String::Utf8Value(pIsolate, value);
}

v8::Local<v8::UnboundScript> compileScript(const char* script) {
    auto* pIsolate = v8::Isolate::GetCurrent();
    v8::EscapableHandleScope hScope(pIsolate);

    auto source_str = v8::String::NewFromUtf8(pIsolate, script);
    v8::ScriptCompiler::Source source(source_str);
    v8::TryCatch TryCatch(pIsolate);
    auto mScript = v8::ScriptCompiler::CompileUnboundScript(pIsolate, &source);
    if (mScript.IsEmpty()) {
        trace("failed to compile script: " << getString(TryCatch.Exception()));
        return {};
    }
    return hScope.Escape(mScript.ToLocalChecked());
}

void protectContext(v8::Local<v8::Context>& context) {
    traceh("protecting context");
    auto* pIsolate = v8::Isolate::GetCurrent();
    v8::HandleScope hScope(pIsolate);
    auto Global = context->Global();
    auto mPropNames = Global->GetPropertyNames(context, v8::KeyCollectionMode::kIncludePrototypes,
                                               v8::PropertyFilter::ALL_PROPERTIES, v8::IndexFilter::kSkipIndices);
    if (mPropNames.IsEmpty()) {
        trace("failed to get property names of global object");
        return;
    }
    auto propNames = mPropNames.ToLocalChecked();
    for (uint32_t i = 0; i < propNames->Length(); ++i) {
        auto keyVal = propNames->Get(context, i).ToLocalChecked();
        auto key = v8::Local<v8::Name>::Cast(keyVal);
        auto prev_attribs = Global->GetPropertyAttributes(context, key).ToChecked();
        auto val = Global->Get(context, key).ToLocalChecked();
        v8::PropertyDescriptor descriptor(val, false);
        descriptor.set_enumerable(false);
        descriptor.set_configurable(false);
        v8::TryCatch TryCatch(pIsolate);
        auto mResult = Global->DefineProperty(context, key, descriptor);
        if (mResult.IsNothing()) {
            trace("failed to protect property: " << getString(TryCatch.Exception()));
        }
        auto lResult = !mResult.IsNothing() && mResult.ToChecked();
        auto attribs = Global->GetPropertyAttributes(context, key).ToChecked();
        trace("protected: " << std::setw(31) << getString(key) << " - " << (lResult ? "ok" : "fl") <<
              "; prev-attribs=" << std::setw(2) << prev_attribs <<
              "; attribs=" << std::setw(2) << attribs);
    }
}

void clearContext(v8::Local<v8::Context>& context) {
    traceh("clearing context");
    auto* pIsolate = v8::Isolate::GetCurrent();
    v8::HandleScope hScope(pIsolate);
    auto Global = context->Global();
    auto mPropNames = Global->GetPropertyNames(context, v8::KeyCollectionMode::kIncludePrototypes,
                                               v8::PropertyFilter::ALL_PROPERTIES, v8::IndexFilter::kSkipIndices);
    if (mPropNames.IsEmpty()) {
        trace("failed to get property names of global object");
        return;
    }
    auto propNames = mPropNames.ToLocalChecked();
    for (uint32_t i = 0; i < propNames->Length(); ++i) {
        auto key = propNames->Get(context, i).ToLocalChecked();
        auto attribs = Global->GetPropertyAttributes(context, key).ToChecked();
        v8::TryCatch TryCatch(pIsolate);
        auto mResult = Global->Delete(context, key);
        if (TryCatch.HasCaught()) {
            trace("failed to delete property: " << getString(TryCatch.Exception()));
        }
        auto lResult = !mResult.IsNothing() && mResult.ToChecked();
        trace("deleted: " << std::setw(33) << getString(key) << " - " << (lResult ? "ok" : "fl") <<
              "; prev-attribs=" << std::setw(2) << attribs);
    }
}

int main() {
    v8::V8::InitializeICU();
    auto platform_ptr = v8::platform::NewDefaultPlatform();
    v8::V8::InitializePlatform(platform_ptr.get());
    v8::V8::Initialize();

    v8::Isolate::CreateParams create_params;
    create_params.array_buffer_allocator = v8::ArrayBuffer::Allocator::NewDefaultAllocator();
    auto* pIsolate = v8::Isolate::New(create_params);
    {
        v8::Isolate::Scope iScope(pIsolate);
        {
            v8::HandleScope hScope(pIsolate);
            v8::Local<v8::UnboundScript> UnboundScript;
            {
                auto Context = v8::Context::New(pIsolate);
                {
                    v8::Context::Scope cScope(Context);
                    UnboundScript = compileScript(_script);
                }
            }
            {
                auto Context = v8::Context::New(pIsolate);
                {
                    v8::Context::Scope cScope(Context);

                    protectContext(Context);

                    auto Script = UnboundScript->BindToCurrentContext();
                    trace("Script::Run - " << (Script->Run(Context).IsEmpty() ? "fail" : "ok"));

                    clearContext(Context);
                }
            }
        }
    }
    pIsolate->Dispose();

    v8::V8::ShutdownPlatform();
    return 0;
}

在运行之后它在 v8-7.5 下（最新 chrome-稳定）我得到

deleted:                         test_func - fl; prev-attribs= 4

删除失败，因为 4 是 configure: false

Answer 1

我在你的代码中没有看到拦截器，但除此之外...

当脚本使用 Object.defineProperty(global, name, ...) 时，当 name 不是数组索引时，将调用 GenericNamedPropertyDefinerCallback。

我没有意识到常规的 function foo() {...} 定义也被安装为不可配置的 (TIL ☺)。要拦截这些拦截器，您还需要两个拦截器：一个 GenericNamedPropertyQueryCallback that returns true（表示 "this property exists already"）和一个 GenericNamedPropertySetterCallback，如果查询回调表示属性存在，将调用到 "overwrite" 它。请注意，您必须注意属性的实际存储。或者您可以简单地阻止在全局对象上设置属性的所有尝试，强制所有代码在 IIFE (function() { /* all code here */ })() 中运行。想想看，也许在你的嵌入代码中应用这样的包装是实现你的目标的更简单的方法......除了 globalThis，我想。

为了完整起见：如果您还想拦截整数索引 properties/functions，您将需要相应的索引拦截器（IndexedPropertySetterCallback 等）。

我通过查看 V8 的源代码将其拼凑在一起，但我自己还没有尝试过。如果它不起作用，请告诉我，如果可以，请包含您的代码。

有什么方法可以拦截 v8 上下文的全局对象中的函数定义吗？

Is there any way to intercept function definition in global object of v8 context?

javascript

v8