Code: static void initializeHolderIfNeeded(ScriptState* scriptState, v8::Local<v8::Object> classObject, v8::Local<v8::Value> holder)
{
    RELEASE_ASSERT(!holder.IsEmpty());
    RELEASE_ASSERT(holder->IsObject());
    v8::Local<v8::Object> holderObject = v8::Local<v8::Object>::Cast(holder);
    v8::Isolate* isolate = scriptState->isolate();
    v8::Local<v8::Context> context = scriptState->context();
    auto privateIsInitialized = V8PrivateProperty::getPrivateScriptRunnerIsInitialized(isolate);
    if (privateIsInitialized.hasValue(context, holderObject))
        return; // Already initialized.

    v8::TryCatch block(isolate);
    v8::Local<v8::Value> initializeFunction;
     if (classObject->Get(scriptState->context(), v8String(isolate, "initialize")).ToLocal(&initializeFunction) && initializeFunction->IsFunction()) {
         v8::TryCatch block(isolate);
         v8::Local<v8::Value> result;
        if (!V8ScriptRunner::callFunction(v8::Local<v8::Function>::Cast(initializeFunction), scriptState->getExecutionContext(), holder, 0, 0, isolate).ToLocal(&result)) {
             fprintf(stderr, "Private script error: Object constructor threw an exception.\n");
             dumpV8Message(context, block.Message());
             RELEASE_NOTREACHED();
        }
    }

    if (classObject->GetPrototype() != holderObject->GetPrototype()) {
        if (!v8CallBoolean(classObject->SetPrototype(context, holderObject->GetPrototype()))) {
            fprintf(stderr, "Private script error: SetPrototype failed.\n");
            dumpV8Message(context, block.Message());
            RELEASE_NOTREACHED();
        }
    }
    if (!v8CallBoolean(holderObject->SetPrototype(context, classObject))) {
        fprintf(stderr, "Private script error: SetPrototype failed.\n");
        dumpV8Message(context, block.Message());
        RELEASE_NOTREACHED();
    }

    privateIsInitialized.set(context, holderObject, v8Boolean(true, isolate));
}

Vulnerability Type: XSS 
CWE ID: CWE-79
Summary: Blink in Google Chrome prior to 54.0.2840.59 for Windows, Mac, and Linux; 54.0.2840.85 for Android permitted execution of v8 microtasks while the DOM was in an inconsistent state, which allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via crafted HTML pages.
Commit Message: Blink-in-JS should not run micro tasks

If Blink-in-JS runs micro tasks, there's a risk of causing a UXSS bug
(see 645211 for concrete steps).

This CL makes Blink-in-JS use callInternalFunction (instead of callFunction)
to avoid running micro tasks after Blink-in-JS' callbacks.

BUG=645211

Review-Url: https://codereview.chromium.org/2330843002
Cr-Commit-Position: refs/heads/master@{#417874}