Crash in blink::beforeCallEnteredCallback()

third_party/WebKit/Source/bindings/core/v8/ScriptPromiseResolver.h

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef ScriptPromiseResolver_h
 #define ScriptPromiseResolver_h
 
 #include "bindings/core/v8/ScopedPersistent.h"
 #include "bindings/core/v8/ScriptPromise.h"
 #include "bindings/core/v8/ScriptState.h"
@@ skipping 108 matching lines @@
 
   template <typename T>
   void resolveOrReject(T value, ResolutionState newState) {
     if (m_state != Pending || !getScriptState()->contextIsValid() ||
         !getExecutionContext() || getExecutionContext()->isContextDestroyed())
       return;
     ASSERT(newState == Resolving || newState == Rejecting);
     m_state = newState;
 
     ScriptState::Scope scope(m_scriptState.get());
+    // TODO(aobzhirov): Converting value to the wrapper can trigger assert
+    // if the script is forbidden.
+    // The script check below will be unreachable in this case.
     m_value.set(m_scriptState->isolate(),
                 ToV8(value, m_scriptState->context()->Global(),
                      m_scriptState->isolate()));
 
     if (getExecutionContext()->isContextSuspended()) {
       // Retain this object until it is actually resolved or rejected.
       keepAliveWhilePending();
       return;
     }
     // TODO(esprehn): This is a hack, instead we should RELEASE_ASSERT that
@@ skipping 24 matching lines @@
 
 #if DCHECK_IS_ON()
   // True if promise() is called.
   bool m_isPromiseCalled = false;
 #endif
 };
 
 }  // namespace blink
 
 #endif  // ScriptPromiseResolver_h