Revert "Revert "Replace ScriptWrappable pointer masking with back-pointer check in DOMDataStore.""

Source/bindings/v8/DOMDataStore.h

Index: Source/bindings/v8/DOMDataStore.h
diff --git a/Source/bindings/v8/DOMDataStore.h b/Source/bindings/v8/DOMDataStore.h
index 46f56c9603de9159a5fc2bb92f681d19dc6a7951..2d1d7b16a3873ce0c5d61a853dfd2593d0b3b290 100644
--- a/Source/bindings/v8/DOMDataStore.h
+++ b/Source/bindings/v8/DOMDataStore.h
@@ -61,8 +61,12 @@ public:
         // way is to check whether the wrappable's wrapper is the same as
         // the holder.
         if ((!DOMWrapperWorld::isolatedWorldsExist() && !canExistInWorker(object)) || holderContainsWrapper(container, holder)) {
-            if (ScriptWrappable::wrapperCanBeStoredInObject(object))
-                return ScriptWrappable::getUnsafeWrapperFromObject(object).handle();
+            if (ScriptWrappable::wrapperCanBeStoredInObject(object)) {
+                v8::Handle<v8::Object> result = ScriptWrappable::getUnsafeWrapperFromObject(object).handle();
+                // Security: always guard against malicious tampering.
+                RELEASE_ASSERT(result.IsEmpty() || result->GetAlignedPointerFromInternalField(v8DOMWrapperObjectIndex) == static_cast<void*>(object));
+                return result;
+            }
             return mainWorldStore()->m_wrapperMap.get(object);
         }
         return current(container.GetIsolate())->get(object);
@@ -72,8 +76,12 @@ public:
     static v8::Handle<v8::Object> getWrapper(T* object, v8::Isolate* isolate)
     {
         if (ScriptWrappable::wrapperCanBeStoredInObject(object) && !canExistInWorker(object)) {
-            if (LIKELY(!DOMWrapperWorld::isolatedWorldsExist()))
-                return ScriptWrappable::getUnsafeWrapperFromObject(object).handle();
+            if (LIKELY(!DOMWrapperWorld::isolatedWorldsExist())) {
+                v8::Handle<v8::Object> result = ScriptWrappable::getUnsafeWrapperFromObject(object).handle();
+                // Security: always guard against malicious tampering.
+                RELEASE_ASSERT(result.IsEmpty() || result->GetAlignedPointerFromInternalField(v8DOMWrapperObjectIndex) == static_cast<void*>(object));
+                return result;
+            }
         }
         return current(isolate)->get(object);
     }