commit a0b5c2a12199d02719e70d6206a42cc7973b0a94
author Yuki Shiino <yukishiino@chromium.org> Thu May 16 01:45:04 2019
committer Commit Bot <commit-bot@chromium.org> Thu May 16 01:45:04 2019
tree 6c52d99849f7068320a531581ecc8e12abfdca59
parent 8535cd192b57aa398b967b601766fec3e37855e2

v8binding: beforeunload: Run toString in the callback context

The return value of onbeforeunload event handler is processed
in a special way at js_event_handler.cc, outside a generated
callback function class such as V8EventHandlerNonNull.

If JS return value is
    {toString: function() { return ...; }}
then, the type conversion from v8::Value to WTF::String causes
an invocation of author function, and the author function must
run as part of the IDL callback function, i.e. with the correct
current realm and correct incumbent realm.

This patch adds a hack to run the string conversion with the
correct current and incumbent realms.

Change-Id: Ia56141aecb5b3b7912fdb72a8b4e5349ff0d4b4c
Bug: 963375
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1611699
Reviewed-by: Hitoshi Yoshida <peria@chromium.org>
Reviewed-by: Kentaro Hara <haraken@chromium.org>
Commit-Queue: Yuki Shiino <yukishiino@chromium.org>
Cr-Commit-Position: refs/heads/master@{#660252}