ScriptPromise should check the constructor paraemter.

Source/bindings/v8/ScriptPromise.cpp

 /*
  * Copyright (C) 2013 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 21 matching lines @@
 #include "bindings/v8/ScriptPromise.h"
 
 #include "bindings/v8/V8Binding.h"
 #include "bindings/v8/V8DOMWrapper.h"
 #include "bindings/v8/custom/V8PromiseCustom.h"
 
 #include <v8.h>
 
 namespace WebCore {
 
+ScriptPromise::ScriptPromise(v8::Handle<v8::Value> value, v8::Isolate* isolate)
+{
+    if (value.IsEmpty() || !V8PromiseCustom::isPromise(value, isolate)) {
+        m_promise = ScriptValue(v8::Handle<v8::Value>(), isolate);
+        V8ThrowException::throwTypeError("the given value is not a Promise", isolate);
+        return;
+    }
+    m_promise = ScriptValue(value, isolate);
+}
+
 ScriptPromise ScriptPromise::then(PassOwnPtr<ScriptFunction> onFulfilled, PassOwnPtr<ScriptFunction> onRejected)
 {
     if (m_promise.hasNoValue() || !m_promise.isObject())
         return ScriptPromise();
     v8::Handle<v8::Object> promise = m_promise.v8Value().As<v8::Object>();
     return ScriptPromise(V8PromiseCustom::then(promise, adoptByGarbageCollector(onFulfilled), adoptByGarbageCollector(onRejected), isolate()), isolate());
 }
 
-ScriptPromise::ScriptPromise(const ScriptValue& value)
+ScriptPromise ScriptPromise::createPending()
 {
-    if (value.hasNoValue())
-        return;
-    v8::Local<v8::Value> v8Value(value.v8Value());
-    v8::Isolate* isolate = value.isolate();
-    if (V8PromiseCustom::isPromise(v8Value, isolate)) {
-        m_promise = value;
-        return;
-    }
-    m_promise = ScriptValue(V8PromiseCustom::toPromise(v8Value, isolate), isolate);
+    v8::Isolate* isolate = v8::Isolate::GetCurrent();
+    ASSERT(isolate->InContext());
+    v8::Handle<v8::Object> promise = V8PromiseCustom::createPromise(v8::Object::New(isolate), isolate);
+    return ScriptPromise(promise, isolate);
 }
 
 ScriptPromise ScriptPromise::createPending(ExecutionContext* context)
 {
     ASSERT(context);
     v8::Isolate* isolate = toIsolate(context);
     ASSERT(isolate->InContext());
     v8::Handle<v8::Context> v8Context = toV8Context(context, DOMWrapperWorld::current(isolate));
     v8::Handle<v8::Object> creationContext = v8Context.IsEmpty() ? v8::Object::New(isolate) : v8Context->Global();
     v8::Handle<v8::Object> promise = V8PromiseCustom::createPromise(creationContext, isolate);
     return ScriptPromise(promise, isolate);
 }
 
-ScriptPromise ScriptPromise::createPending()
+ScriptPromise ScriptPromise::cast(const ScriptValue& value)
 {
-    v8::Isolate* isolate = v8::Isolate::GetCurrent();
-    ASSERT(isolate->InContext());
-    v8::Handle<v8::Object> promise = V8PromiseCustom::createPromise(v8::Object::New(isolate), isolate);
-    return ScriptPromise(promise, isolate);
+    if (value.hasNoValue())
+        return ScriptPromise();
+    v8::Local<v8::Value> v8Value(value.v8Value());
+    v8::Isolate* isolate = value.isolate();
+    if (V8PromiseCustom::isPromise(v8Value, isolate)) {
+        return ScriptPromise(v8Value, isolate);
+    }
+    return ScriptPromise(V8PromiseCustom::toPromise(v8Value, isolate), isolate);
 }
 
 } // namespace WebCore