When defining custom elements, check that the argument is a constructor

third_party/WebKit/Source/core/dom/custom/CustomElementsRegistry.cpp

 // Copyright 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "core/dom/custom/CustomElementsRegistry.h"
 
 // TODO(dominicc): Stop including Document.h when
 // v0CustomElementIsDefined has been removed.
 #include "bindings/core/v8/DOMWrapperWorld.h"
 #include "bindings/core/v8/ExceptionState.h"
@@ skipping 42 matching lines @@
 
 // http://w3c.github.io/webcomponents/spec/custom/#dfn-element-definition
 void CustomElementsRegistry::define(ScriptState* scriptState,
     const AtomicString& name, const ScriptValue& constructorScriptValue,
     const ElementRegistrationOptions& options, ExceptionState& exceptionState)
 {
     DCHECK(scriptState->world().isMainWorld());
     v8::Isolate* isolate = scriptState->isolate();
     v8::Local<v8::Context> context = scriptState->context();
 
-    // TODO(dominicc): Make this check for constructors and not just
-    // functions when
-    // https://bugs.chromium.org/p/v8/issues/detail?id=4993 is fixed.
     v8::Local<v8::Value> constructorValue = constructorScriptValue.v8Value();
     if (!constructorValue->IsFunction()) {
+        // Not even a function.
         exceptionState.throwTypeError(
             "constructor argument is not a constructor");
         return;
     }
     v8::Local<v8::Object> constructor = constructorValue.As<v8::Object>();
+    if (!constructor->IsConstructor()) {
+        exceptionState.throwTypeError(
+            "constructor argument is not a constructor");
+        return;
+    }
 
     // Raise an exception if the name is not valid.
     if (!CustomElement::isValidName(name)) {
         exceptionState.throwDOMException(
             SyntaxError,
             "\"" + name + "\" is not a valid custom element name");
         return;
     }
 
     // Raise an exception if the name is already in use.
@@ skipping 113 matching lines @@
     return m_v0.get() && m_v0->nameIsDefined(name);
 }
 
 DEFINE_TRACE(CustomElementsRegistry)
 {
     visitor->trace(m_definitions);
     visitor->trace(m_v0);
 }
 
 } // namespace blink