Support non-function object values assigned to EventHandler attributes

Source/bindings/core/v8/V8EventListener.cpp

Index: Source/bindings/core/v8/V8EventListener.cpp
diff --git a/Source/bindings/core/v8/V8EventListener.cpp b/Source/bindings/core/v8/V8EventListener.cpp
index 52872e3189e71b7ddf994a7daf40102e5510200d..19b38366b2013bdcfb8edcb6f0c786523dcf3fe6 100644
--- a/Source/bindings/core/v8/V8EventListener.cpp
+++ b/Source/bindings/core/v8/V8EventListener.cpp
@@ -55,8 +55,14 @@ v8::Local<v8::Function> V8EventListener::getListenerFunction(ScriptState* script
     if (listener->IsFunction())
         return v8::Local<v8::Function>::Cast(listener);
 
+    // The EventHandler callback function type (used for event handler
+    // attributes in HTML) has [TreatNonObjectAsNull], which implies that
+    // non-function objects should be treated as no-op functions that return
+    // undefined.
+    if (isAttribute())
+        return v8::Local<v8::Function>();
+
     if (listener->IsObject()) {
-        ASSERT_WITH_MESSAGE(!isAttribute(), "EventHandler attributes should only accept JS Functions as input.");
         v8::Local<v8::Value> property = listener->Get(v8AtomicString(isolate(), "handleEvent"));
         // Check that no exceptions were thrown when getting the
         // handleEvent property and that the value is a function.