NPObject should not be retrieved as ScriptWrappable

third_party/WebKit/Source/bindings/core/v8/WrapperTypeInfo.h

Index: third_party/WebKit/Source/bindings/core/v8/WrapperTypeInfo.h
diff --git a/third_party/WebKit/Source/bindings/core/v8/WrapperTypeInfo.h b/third_party/WebKit/Source/bindings/core/v8/WrapperTypeInfo.h
index dfdd028b74668c5a59270212f88b0c88b4d94e87..fe8e4eea1e1bec16476252d235762a5917456985 100644
--- a/third_party/WebKit/Source/bindings/core/v8/WrapperTypeInfo.h
+++ b/third_party/WebKit/Source/bindings/core/v8/WrapperTypeInfo.h
@@ -234,24 +234,32 @@ inline T* getInternalField(v8::Local<v8::Object> wrapper)
     return reinterpret_cast<T*>(wrapper->GetAlignedPointerFromInternalField(offset));
 }
 
-inline ScriptWrappable* toScriptWrappable(const v8::PersistentBase<v8::Object>& wrapper)
+inline const WrapperTypeInfo* toWrapperTypeInfo(const v8::PersistentBase<v8::Object>& wrapper)
 {
-    return getInternalField<ScriptWrappable, v8DOMWrapperObjectIndex>(wrapper);
+    return getInternalField<WrapperTypeInfo, v8DOMWrapperTypeIndex>(wrapper);
 }
 
-inline ScriptWrappable* toScriptWrappable(v8::Local<v8::Object> wrapper)
+inline const WrapperTypeInfo* toWrapperTypeInfo(v8::Local<v8::Object> wrapper)
 {
-    return getInternalField<ScriptWrappable, v8DOMWrapperObjectIndex>(wrapper);
+    return getInternalField<WrapperTypeInfo, v8DOMWrapperTypeIndex>(wrapper);
 }
 
-inline const WrapperTypeInfo* toWrapperTypeInfo(const v8::PersistentBase<v8::Object>& wrapper)
+const WrapperTypeInfo* npObjectTypeInfo();
+
+inline ScriptWrappable* toScriptWrappable(const v8::PersistentBase<v8::Object>& wrapper)
 {
-    return getInternalField<WrapperTypeInfo, v8DOMWrapperTypeIndex>(wrapper);
+    // NPObject is not ScriptWrappable. We must not retrieve the pointer

[vivekg, 2015/10/15 11:23:22]

nit: Shall we put a FIXME here to remove the code once we deprecate the usage of
NPObject?

+    // as ScriptWrappable.
+    ASSERT(toWrapperTypeInfo(wrapper) != npObjectTypeInfo());
+    return getInternalField<ScriptWrappable, v8DOMWrapperObjectIndex>(wrapper);
 }
 
-inline const WrapperTypeInfo* toWrapperTypeInfo(v8::Local<v8::Object> wrapper)
+inline ScriptWrappable* toScriptWrappable(v8::Local<v8::Object> wrapper)
 {
-    return getInternalField<WrapperTypeInfo, v8DOMWrapperTypeIndex>(wrapper);
+    // NPObject is not ScriptWrappable. We must not retrieve the pointer
+    // as ScriptWrappable.
+    ASSERT(toWrapperTypeInfo(wrapper) != npObjectTypeInfo());
+    return getInternalField<ScriptWrappable, v8DOMWrapperObjectIndex>(wrapper);
 }
 
 } // namespace blink