binding: Returns a reject promise when |this| is not of the type.

third_party/WebKit/Source/bindings/core/v8/V8DOMConfiguration.cpp

 /*
  * Copyright (C) 2012 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  *
  * 1.  Redistributions of source code must retain the above copyright
  *     notice, this list of conditions and the following disclaimer.
  * 2.  Redistributions in binary form must reproduce the above copyright
@@ skipping 287 matching lines @@
                            v8::Local<v8::Signature> signature,
                            const Configuration& method,
                            const DOMWrapperWorld& world) {
   if (method.exposeConfiguration ==
           V8DOMConfiguration::OnlyExposedToPrivateScript &&
       !world.isPrivateScriptIsolatedWorld())
     return;
 
   v8::Local<v8::Name> name = method.methodName(isolate);
   v8::FunctionCallback callback = method.callbackForWorld(world);
+  // Promise-returning DOM operations need to return a reject promise when
+  // an exception occurs.  This includes a case that the receiver object is not
+  // of the type.  So, we disable the type check of the receiver object on V8
+  // side so that V8 won't throw.  Instead, we do the check on Blink side and
+  // convert an exception to a reject promise.
+  if (method.holderCheckConfiguration == V8DOMConfiguration::DoNotCheckHolder)
+    signature = v8::Local<v8::Signature>();
 
   DCHECK(method.propertyLocationConfiguration);
   if (method.propertyLocationConfiguration &
       (V8DOMConfiguration::OnInstance | V8DOMConfiguration::OnPrototype)) {
     v8::Local<v8::FunctionTemplate> functionTemplate =
         v8::FunctionTemplate::New(isolate, callback, v8::Local<v8::Value>(),
                                   signature, method.length);
     functionTemplate->RemovePrototype();
     if (method.propertyLocationConfiguration & V8DOMConfiguration::OnInstance)
       instanceTemplate->Set(
@@ skipping 26 matching lines @@
     v8::Local<v8::Signature> signature,
     const V8DOMConfiguration::MethodConfiguration& method,
     const DOMWrapperWorld& world) {
   if (method.exposeConfiguration ==
           V8DOMConfiguration::OnlyExposedToPrivateScript &&
       !world.isPrivateScriptIsolatedWorld())
     return;
 
   v8::Local<v8::Name> name = method.methodName(isolate);
   v8::FunctionCallback callback = method.callbackForWorld(world);
+  // Promise-returning DOM operations need to return a reject promise when
+  // an exception occurs.  This includes a case that the receiver object is not
+  // of the type.  So, we disable the type check of the receiver object on V8
+  // side so that V8 won't throw.  Instead, we do the check on Blink side and
+  // convert an exception to a reject promise.
+  if (method.holderCheckConfiguration == V8DOMConfiguration::DoNotCheckHolder)
+    signature = v8::Local<v8::Signature>();
 
   DCHECK(method.propertyLocationConfiguration);
   if (method.propertyLocationConfiguration &
       (V8DOMConfiguration::OnInstance | V8DOMConfiguration::OnPrototype)) {
     v8::Local<v8::FunctionTemplate> functionTemplate =
         v8::FunctionTemplate::New(isolate, callback, v8::Local<v8::Value>(),
                                   signature, method.length);
     functionTemplate->RemovePrototype();
     v8::Local<v8::Function> function =
         functionTemplate->GetFunction(isolate->GetCurrentContext())
@@ skipping 238 matching lines @@
 void V8DOMConfiguration::setClassString(
     v8::Isolate* isolate,
     v8::Local<v8::ObjectTemplate> objectTemplate,
     const char* classString) {
   objectTemplate->Set(
       v8::Symbol::GetToStringTag(isolate), v8AtomicString(isolate, classString),
       static_cast<v8::PropertyAttribute>(v8::ReadOnly | v8::DontEnum));
 }
 
 }  // namespace blink