[async] Fix a crash when AsyncHooks is used in the proto of an object

Bug: chromium:866315
Change-Id: I83074475185c0646d575282d24679e18ec0628c7
Reviewed-on: https://chromium-review.googlesource.com/1146645
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54612}

src/async-hooks-wrapper.cc

@@ -43,6 +43,18 @@ static AsyncHooksWrap* UnwrapHook(
   Isolate* isolate = args.GetIsolate();
   HandleScope scope(isolate);
   Local<Object> hook = args.This();
+
+  AsyncHooks* hooks = PerIsolateData::Get(isolate)->GetAsyncHooks();
+
+  if (!hooks->async_hook_ctor.Get(isolate)->HasInstance(hook)) {
+    isolate->ThrowException(
+        String::NewFromUtf8(
+            isolate, "Invalid 'this' passed instead of AsyncHooks instance",
+            NewStringType::kNormal)
+            .ToLocalChecked());
+    return nullptr;
+  }
+
   Local<External> wrap = Local<External>::Cast(hook->GetInternalField(0));
   void* ptr = wrap->Value();
   return static_cast<AsyncHooksWrap*>(ptr);
@@ -50,12 +62,16 @@ static AsyncHooksWrap* UnwrapHook(
 
 static void EnableHook(const v8::FunctionCallbackInfo<v8::Value>& args) {
   AsyncHooksWrap* wrap = UnwrapHook(args);
-  wrap->Enable();
+  if (wrap) {
+    wrap->Enable();
+  }
 }
 
 static void DisableHook(const v8::FunctionCallbackInfo<v8::Value>& args) {
   AsyncHooksWrap* wrap = UnwrapHook(args);
-  wrap->Disable();
+  if (wrap) {
+    wrap->Disable();
+  }
 }
 
 async_id_t AsyncHooks::GetExecutionAsyncId() const {

src/async-hooks-wrapper.h

@@ -69,10 +69,11 @@ class AsyncHooks {
 
   Local<Object> CreateHook(const v8::FunctionCallbackInfo<v8::Value>& args);
 
+  Persistent<FunctionTemplate> async_hook_ctor;
+
  private:
   std::vector<AsyncHooksWrap*> async_wraps_;
   Isolate* isolate_;
-  Persistent<FunctionTemplate> async_hook_ctor;
   Persistent<ObjectTemplate> async_hooks_templ;
   Persistent<Private> async_id_smb;
   Persistent<Private> trigger_id_smb;

test/mjsunit/regress/regress-crbug-866315.js

+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-async-hooks
+
+let num = 42;
+let ah = async_hooks.createHook({});
+
+num.__proto__.__proto__ = ah;
+assertThrows('num.enable()');
+assertThrows('num.disable()');