[megadom] Fix crash in d8 when realm is entered

Bug: chromium:1329234
Change-Id: I59f171d3e2ab0c07f79f631971b1695b9f706600
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3677294Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80850}

src/d8/d8.cc

@@ -3002,7 +3002,9 @@ void Shell::NodeTypeCallback(const v8::FunctionCallbackInfo<v8::Value>& args) {
   v8::Isolate* isolate = args.GetIsolate();
   // TODO(mslekova): Enable this once we have signature check in TF.
   PerIsolateData* data = PerIsolateData::Get(isolate);
-  CHECK(data->GetDomNodeCtor()->HasInstance(args.This()));
+  if (!data->GetDomNodeCtor()->HasInstance(args.This())) {
+    isolate->ThrowError("Calling .nodeType on wrong instance type.");
+  }
 
   args.GetReturnValue().Set(v8::Number::New(isolate, 1));
 }

test/mjsunit/regress/regress-crbug-1329234.js

+// Copyright 2022 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+try {
+  Realm.createAllowCrossRealmAccess();
+  var div = new d8.dom.Div();
+  div['nodeType']();
+} catch (err) {
+  console.log(err);
+}