NPObject should not be retrieved as ScriptWrappable

third_party/WebKit/Source/bindings/core/v8/WrapperTypeInfo.h

 /*
  * Copyright (C) 2010 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 216 matching lines @@
     return reinterpret_cast<T*>(v8::Object::GetAlignedPointerFromInternalField(persistent, offset));
 }
 
 template<typename T, int offset>
 inline T* getInternalField(v8::Local<v8::Object> wrapper)
 {
     ASSERT(offset < wrapper->InternalFieldCount());
     return reinterpret_cast<T*>(wrapper->GetAlignedPointerFromInternalField(offset));
 }
 
-inline ScriptWrappable* toScriptWrappable(const v8::PersistentBase<v8::Object>& wrapper)
-{
-    return getInternalField<ScriptWrappable, v8DOMWrapperObjectIndex>(wrapper);
-}
-
-inline ScriptWrappable* toScriptWrappable(v8::Local<v8::Object> wrapper)
-{
-    return getInternalField<ScriptWrappable, v8DOMWrapperObjectIndex>(wrapper);
-}
-
 inline const WrapperTypeInfo* toWrapperTypeInfo(const v8::PersistentBase<v8::Object>& wrapper)
 {
     return getInternalField<WrapperTypeInfo, v8DOMWrapperTypeIndex>(wrapper);
 }
 
 inline const WrapperTypeInfo* toWrapperTypeInfo(v8::Local<v8::Object> wrapper)
 {
     return getInternalField<WrapperTypeInfo, v8DOMWrapperTypeIndex>(wrapper);
 }
 
+const WrapperTypeInfo* npObjectTypeInfo();
+
+inline ScriptWrappable* toScriptWrappable(const v8::PersistentBase<v8::Object>& wrapper)
+{
+    // NPObject is not ScriptWrappable. We must not retrieve the pointer

[vivekg, 2015/10/15 11:23:22]

nit: Shall we put a FIXME here to remove the code once we deprecate the usage of
NPObject?

+    // as ScriptWrappable.
+    ASSERT(toWrapperTypeInfo(wrapper) != npObjectTypeInfo());
+    return getInternalField<ScriptWrappable, v8DOMWrapperObjectIndex>(wrapper);
+}
+
+inline ScriptWrappable* toScriptWrappable(v8::Local<v8::Object> wrapper)
+{
+    // NPObject is not ScriptWrappable. We must not retrieve the pointer
+    // as ScriptWrappable.
+    ASSERT(toWrapperTypeInfo(wrapper) != npObjectTypeInfo());
+    return getInternalField<ScriptWrappable, v8DOMWrapperObjectIndex>(wrapper);
+}
+
 } // namespace blink
 
 #endif // WrapperTypeInfo_h