Crash in blink::beforeCallEnteredCallback()

third_party/WebKit/Source/bindings/core/v8/ScriptPromiseResolver.h

Index: third_party/WebKit/Source/bindings/core/v8/ScriptPromiseResolver.h
diff --git a/third_party/WebKit/Source/bindings/core/v8/ScriptPromiseResolver.h b/third_party/WebKit/Source/bindings/core/v8/ScriptPromiseResolver.h
index 489183609fb3db8c8f08d48ca3bf8d3c230edde6..46e4851c6913c4ae83ba44b39c054fdd480dc521 100644
--- a/third_party/WebKit/Source/bindings/core/v8/ScriptPromiseResolver.h
+++ b/third_party/WebKit/Source/bindings/core/v8/ScriptPromiseResolver.h
@@ -126,6 +126,9 @@ class CORE_EXPORT ScriptPromiseResolver
     m_state = newState;
 
     ScriptState::Scope scope(m_scriptState.get());
+    // TODO(aobzhirov): Converting value to the wrapper can trigger assert
+    // if the script is forbidden.
+    // The script check below will be unreachable in this case.
     m_value.set(m_scriptState->isolate(),
                 toV8(value, m_scriptState->context()->Global(),
                      m_scriptState->isolate()));