Never resolve promises inside ScriptForbiddenScopes.

third_party/WebKit/Source/bindings/core/v8/ScriptPromiseResolver.h

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef ScriptPromiseResolver_h
 #define ScriptPromiseResolver_h
 
 #include "bindings/core/v8/ScopedPersistent.h"
 #include "bindings/core/v8/ScriptPromise.h"
 #include "bindings/core/v8/ScriptState.h"
 #include "bindings/core/v8/ToV8.h"
 #include "core/CoreExport.h"
 #include "core/dom/ActiveDOMObject.h"
 #include "core/dom/ExecutionContext.h"
+#include "platform/ScriptForbiddenScope.h"
 #include "platform/Timer.h"
 #include "platform/heap/Handle.h"
 #include "platform/heap/SelfKeepAlive.h"
 #include <v8.h>
 
 namespace blink {
 
 // This class wraps v8::Promise::Resolver and provides the following
 // functionalities.
 //  - A ScriptPromiseResolver retains a ScriptState. A caller
@@ skipping 103 matching lines @@
     ScriptState::Scope scope(m_scriptState.get());
     m_value.set(m_scriptState->isolate(),
                 toV8(value, m_scriptState->context()->Global(),
                      m_scriptState->isolate()));
 
     if (getExecutionContext()->activeDOMObjectsAreSuspended()) {
       // Retain this object until it is actually resolved or rejected.
       keepAliveWhilePending();
       return;
     }
+    // TODO(esprehn): This is a hack, instead we should RELEASE_ASSERT that
+    // script is allowed, and v8 should be running the entry hooks below and
+    // crashing if script is forbidden. We should then audit all users of
+    // ScriptPromiseResolver and the related specs and switch to an async
+    // resolve.
+    // See: http://crbug.com/663476
+    if (ScriptForbiddenScope::isScriptForbidden()) {
+      m_timer.startOneShot(0, BLINK_FROM_HERE);
+      return;
+    }
     resolveOrRejectImmediately();
   }
 
   void resolveOrRejectImmediately();
   void onTimerFired(TimerBase*);
 
   ResolutionState m_state;
   const RefPtr<ScriptState> m_scriptState;
   Timer<ScriptPromiseResolver> m_timer;
   Resolver m_resolver;
   ScopedPersistent<v8::Value> m_value;
 
   // To support keepAliveWhilePending(), this object needs to keep itself
   // alive while in that state.
   SelfKeepAlive<ScriptPromiseResolver> m_keepAlive;
 
 #if ENABLE(ASSERT)
   // True if promise() is called.
   bool m_isPromiseCalled;
 #endif
 };
 
 }  // namespace blink
 
 #endif  // ScriptPromiseResolver_h