Don't run handleEvent getter in V8EventListener::getListenerFunction if script is forbidden.

It results in arbitrary code execution under ScriptForbiddenScopes. :(

BUG=655904

Review-Url: https://codereview.chromium.org/2423623002
Cr-Commit-Position: refs/heads/master@{#425763}

third_party/WebKit/Source/bindings/core/v8/V8EventListener.cpp

diff --git a/third_party/WebKit/Source/bindings/core/v8/V8EventListener.cpp b/third_party/WebKit/Source/bindings/core/v8/V8EventListener.cpp
index fa788f05..9acda710 100644
--- a/third_party/WebKit/Source/bindings/core/v8/V8EventListener.cpp
+++ b/third_party/WebKit/Source/bindings/core/v8/V8EventListener.cpp
@@ -62,6 +62,12 @@
   if (isAttribute())
     return v8::Local<v8::Function>();
 
+  // Getting the handleEvent property can runs script in the getter.
+  if (ScriptForbiddenScope::isScriptForbidden()) {
+    V8ThrowException::throwError(isolate(), "Script execution is forbidden.");
+    return v8::Local<v8::Function>();
+  }
+
   if (listener->IsObject()) {
     // Check that no exceptions were thrown when getting the
     // handleEvent property and that the value is a function.