When defining custom elements, check that the argument is a constructor

third_party/WebKit/Source/core/dom/custom/CustomElementsRegistry.cpp

Index: third_party/WebKit/Source/core/dom/custom/CustomElementsRegistry.cpp
diff --git a/third_party/WebKit/Source/core/dom/custom/CustomElementsRegistry.cpp b/third_party/WebKit/Source/core/dom/custom/CustomElementsRegistry.cpp
index b9a5c707fa11be748539b66dcac9edcd4d2d0dcb..6163dced4530d47532ca1639222c3e9ac9f85fd2 100644
--- a/third_party/WebKit/Source/core/dom/custom/CustomElementsRegistry.cpp
+++ b/third_party/WebKit/Source/core/dom/custom/CustomElementsRegistry.cpp
@@ -60,16 +60,19 @@ void CustomElementsRegistry::define(ScriptState* scriptState,
     v8::Isolate* isolate = scriptState->isolate();
     v8::Local<v8::Context> context = scriptState->context();
 
-    // TODO(dominicc): Make this check for constructors and not just
-    // functions when
-    // https://bugs.chromium.org/p/v8/issues/detail?id=4993 is fixed.
     v8::Local<v8::Value> constructorValue = constructorScriptValue.v8Value();
     if (!constructorValue->IsFunction()) {
+        // Not even a function.
         exceptionState.throwTypeError(
             "constructor argument is not a constructor");
         return;
     }
     v8::Local<v8::Object> constructor = constructorValue.As<v8::Object>();
+    if (!constructor->IsConstructor()) {
+        exceptionState.throwTypeError(
+            "constructor argument is not a constructor");
+        return;
+    }
 
     // Raise an exception if the name is not valid.
     if (!CustomElement::isValidName(name)) {