Don't run handleEvent getter in V8EventListener::getListenerFunction if script is forbidden.

third_party/WebKit/Source/bindings/core/v8/V8EventListener.cpp

 /*
  * Copyright (C) 2006, 2007, 2008, 2009 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 44 matching lines @@
   if (listener->IsFunction())
     return v8::Local<v8::Function>::Cast(listener);
 
   // The EventHandler callback function type (used for event handler
   // attributes in HTML) has [TreatNonObjectAsNull], which implies that
   // non-function objects should be treated as no-op functions that return
   // undefined.
   if (isAttribute())
     return v8::Local<v8::Function>();
 
+  // Getting the handleEvent property can runs script in the getter.
+  if (ScriptForbiddenScope::isScriptForbidden()) {
+    V8ThrowException::throwError(isolate(), "Script execution is forbidden.");
+    return v8::Local<v8::Function>();
+  }
+
   if (listener->IsObject()) {
     // Check that no exceptions were thrown when getting the
     // handleEvent property and that the value is a function.
     v8::Local<v8::Value> property;
     if (listener
             ->Get(scriptState->context(),
                   v8AtomicString(isolate(), "handleEvent"))
             .ToLocal(&property) &&
         property->IsFunction())
       return v8::Local<v8::Function>::Cast(property);
@@ skipping 29 matching lines @@
   v8::Local<v8::Value> result;
   if (!V8ScriptRunner::callFunction(handlerFunction, frame->document(),
                                     receiver, WTF_ARRAY_LENGTH(parameters),
                                     parameters, scriptState->isolate())
            .ToLocal(&result))
     return v8::Local<v8::Value>();
   return result;
 }
 
 }  // namespace blink