bindings: Fixes [LenientThis] to refer to the correct object.

third_party/WebKit/Source/bindings/templates/attributes.cpp

 {% from 'conversions.cpp' import declare_enum_validation_variable, v8_value_to_local_cpp_value %}
 
 
 {##############################################################################}
 {% macro attribute_getter(attribute, world_suffix) %}
 {% filter conditional(attribute.conditional_string) %}
 static void {{attribute.name}}AttributeGetter{{world_suffix}}(
 {%- if attribute.is_data_type_property %}
 const v8::PropertyCallbackInfo<v8::Value>& info
 {%- else %}
 const v8::FunctionCallbackInfo<v8::Value>& info
 {%- endif %})
 {
     {% if attribute.is_reflect and not attribute.is_url
           and attribute.idl_type == 'DOMString' and is_node
           and not attribute.is_implemented_in_private_script %}
     {% set cpp_class, v8_class = 'Element', 'V8Element' %}
     {% endif %}
     {# holder #}
     {% if not attribute.is_static %}
     {% if attribute.is_lenient_this %}
-    v8::Local<v8::Object> holder = {{v8_class}}::findInstanceInPrototypeChain(info.This(), info.GetIsolate());
-    if (holder.IsEmpty())
+    {# Make sure that info.Holder() really points to an instance if [LenientThis]. #}
+    if (!{{v8_class}}::hasInstance(info.Holder(), info.GetIsolate()))
         return; // Return silently because of [LenientThis].
-    // Note that it's okay to use |holder|, but |info.Holder()| is still unsafe
-    // and must not be used.
-    {% else %}
+    {% endif %}
     v8::Local<v8::Object> holder = info.Holder();
     {% endif %}
-    {% endif %}
     {# impl #}
     {% if attribute.cached_attribute_validation_method %}
     v8::Local<v8::String> propertyName = v8AtomicString(info.GetIsolate(), "{{attribute.name}}");
     {{cpp_class}}* impl = {{v8_class}}::toImpl(holder);
     if (!impl->{{attribute.cached_attribute_validation_method}}()) {
         v8::Local<v8::Value> v8Value = V8HiddenValue::getHiddenValue(ScriptState::current(info.GetIsolate()), holder, propertyName);
         if (!v8Value.IsEmpty()) {
             v8SetReturnValue(info, v8Value);
             return;
         }
@@ skipping 203 matching lines @@
     {% set raise_exception = 1 %}
     {% else %}
     {% set raise_exception = 0 %}
     {% endif %}
     {# Local variables #}
     {% if (not attribute.is_static and
            not attribute.is_replaceable and
            not attribute.constructor_type) or
           raise_exception %}
     {% if attribute.is_lenient_this %}
-    v8::Local<v8::Object> holder = {{v8_class}}::findInstanceInPrototypeChain(info.This(), info.GetIsolate());
-    if (holder.IsEmpty())
+    {# Make sure that info.Holder() really points to an instance if [LenientThis]. #}
+    if (!{{v8_class}}::hasInstance(info.Holder(), info.GetIsolate()))
         return; // Return silently because of [LenientThis].
-    // Note that it's okay to use |holder|, but |info.Holder()| is still unsafe
-    // and must not be used.
-    {% else %}
+    {% endif %}
     v8::Local<v8::Object> holder = info.Holder();
     {% endif %}
-    {% endif %}
     {% if raise_exception %}
     ExceptionState exceptionState(ExceptionState::SetterContext, "{{attribute.name}}", "{{interface_name}}", holder, info.GetIsolate());
     {% endif %}
     {% if attribute.is_replaceable or
           attribute.constructor_type %}
     v8::Local<v8::String> propertyName = v8AtomicString(info.GetIsolate(), "{{attribute.name}}");
     {% endif %}
     {# impl #}
     {% if attribute.is_put_forwards %}
     {{cpp_class}}* proxyImpl = {{v8_class}}::toImpl(holder);
@@ skipping 239 matching lines @@
        setter_callback_for_main_world,
        wrapper_type_info,
        access_control,
        property_attribute,
        only_exposed_to_private_script,
        property_location(attribute),
        holder_check,
    ] %}
 {{'{'}}{{attribute_configuration_list | join(', ')}}{{'}'}}
 {%- endmacro %}