Restrict PromiseRejectionEvents to their originating world

Source/core/events/Event.h

Index: Source/core/events/Event.h
diff --git a/Source/core/events/Event.h b/Source/core/events/Event.h
index 6242b0b67a6a3448137d54d82abe4500354dd832..1542b7a0d821499a05bea9b007f7addda3b1eafb 100644
--- a/Source/core/events/Event.h
+++ b/Source/core/events/Event.h
@@ -35,6 +35,7 @@
 
 namespace blink {
 
+class DOMWrapperWorld;
 class EventTarget;
 class ExecutionContext;
 
@@ -185,6 +186,10 @@ public:
     double uiCreateTime() const { return m_uiCreateTime; }
     void setUICreateTime(double uiCreateTime) { m_uiCreateTime = uiCreateTime; }
 
+    // Events that must not leak across isolated world, similar to how
+    // ErrorEvent behaves, can override this method.
+    virtual bool canBeDispatchedInWorld(const DOMWrapperWorld&) const { return true; }
+
     DECLARE_VIRTUAL_TRACE();
 
 protected: