v8binding: Make the wrapper check stricter.

Uses a new V8 API, v8::Object::IsApiWrapper, to improve the
check to determine whether a given v8::Value is a wrapper
object or not.

Bug: 999262
Change-Id: I844b20e6a36e1126fdbaf203db75b4c669ba385f
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1777354Reviewed-by: Kentaro Hara <haraken@chromium.org>
Reviewed-by: Hitoshi Yoshida <peria@chromium.org>
Commit-Queue: Yuki Shiino <yukishiino@chromium.org>
Cr-Commit-Position: refs/heads/master@{#692629}

third_party/blink/renderer/platform/bindings/v8_dom_wrapper.cc

@@ -73,7 +73,10 @@ v8::Local<v8::Object> V8DOMWrapper::CreateWrapper(
 bool V8DOMWrapper::IsWrapper(v8::Isolate* isolate, v8::Local<v8::Value> value) {
   if (value.IsEmpty() || !value->IsObject())
     return false;
+
   v8::Local<v8::Object> object = v8::Local<v8::Object>::Cast(value);
+  if (!object->IsApiWrapper())
+    return false;
 
   if (object->InternalFieldCount() < kV8DefaultWrapperInternalFieldCount)
     return false;
@@ -89,7 +92,10 @@ bool V8DOMWrapper::IsWrapper(v8::Isolate* isolate, v8::Local<v8::Value> value) {
 bool V8DOMWrapper::HasInternalFieldsSet(v8::Local<v8::Value> value) {
   if (value.IsEmpty() || !value->IsObject())
     return false;
+
   v8::Local<v8::Object> object = v8::Local<v8::Object>::Cast(value);
+  if (!object->IsApiWrapper())
+    return false;
 
   if (object->InternalFieldCount() < kV8DefaultWrapperInternalFieldCount)
     return false;