Fix an overflow in valueAsDate setter of temporal input types.

third_party/WebKit/Source/bindings/core/v8/V8Binding.h

 /*
 * Copyright (C) 2009 Google Inc. All rights reserved.
 * Copyright (C) 2012 Ericsson AB. All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions are
 * met:
 *
 *     * Redistributions of source code must retain the above copyright
 * notice, this list of conditions and the following disclaimer.
@@ skipping 544 matching lines @@
 CORE_EXPORT String toByteString(v8::Isolate*, v8::Local<v8::Value>, ExceptionState&);
 
 // Converts a value to a String, replacing unmatched UTF-16 surrogates with replacement characters.
 CORE_EXPORT String toUSVString(v8::Isolate*, v8::Local<v8::Value>, ExceptionState&);
 
 inline v8::Local<v8::Boolean> v8Boolean(bool value, v8::Isolate* isolate)
 {
     return value ? v8::True(isolate) : v8::False(isolate);
 }
 
-inline double toCoreDate(v8::Isolate* isolate, v8::Local<v8::Value> object)
+inline double toCoreDate(v8::Isolate* isolate, v8::Local<v8::Value> object, ExceptionState& exceptionState)
 {
-    if (object->IsDate())
-        return object.As<v8::Date>()->ValueOf();
-    if (object->IsNumber())
-        return object.As<v8::Number>()->Value();
-    return std::numeric_limits<double>::quiet_NaN();
+    if (object->IsNull())
+        return std::numeric_limits<double>::quiet_NaN();
+    if (!object->IsDate()) {
+        exceptionState.throwTypeError("The provided value is not a Date.");
+        return 0;
+    }
+    return object.As<v8::Date>()->ValueOf();
 }
 
 inline v8::MaybeLocal<v8::Value> v8DateOrNaN(v8::Isolate* isolate, double value)
 {
     ASSERT(isolate);
     return v8::Date::New(isolate->GetCurrentContext(), std::isfinite(value) ? value : std::numeric_limits<double>::quiet_NaN());
 }
 
 // FIXME: Remove the special casing for NodeFilter and XPathNSResolver.
 NodeFilter* toNodeFilter(v8::Local<v8::Value>, v8::Local<v8::Object>, ScriptState*);
@@ skipping 375 matching lines @@
 typedef void (*InstallTemplateFunction)(v8::Isolate*, const DOMWrapperWorld&, v8::Local<v8::FunctionTemplate> interfaceTemplate);
 
 // Freeze a V8 object. The type of the first parameter and the return value is
 // intentionally v8::Value so that this function can wrap toV8().
 // If the argument isn't an object, this will crash.
 CORE_EXPORT v8::Local<v8::Value> freezeV8Object(v8::Local<v8::Value>, v8::Isolate*);
 
 } // namespace blink
 
 #endif // V8Binding_h