1 files changed, 10 insertions, 1 deletions
diff --git a/xfa/fxjse/util_inline.h b/xfa/fxjse/util_inline.h
index 336886b666..e61dc6aa80 100644
--- a/xfa/fxjse/util_inline.h
+++ b/xfa/fxjse/util_inline.h
@@ -20,7 +20,8 @@ static V8_INLINE void FXJSE_UpdateObjectBinding(v8::Local<v8::Object>& hObject,
   hObject->SetAlignedPointerInInternalField(0, lpNewBinding);
 }
 static V8_INLINE void* FXJSE_RetrieveObjectBinding(
-    const v8::Local<v8::Object>& hJSObject) {
+    const v8::Local<v8::Object>& hJSObject,
+    CFXJSE_Class* lpClass = NULL) {
   ASSERT(!hJSObject.IsEmpty());
   if (!hJSObject->IsObject()) {
     return NULL;
@@ -36,6 +37,14 @@ static V8_INLINE void* FXJSE_RetrieveObjectBinding(
       return NULL;
     }
   }
+  if (lpClass) {
+    v8::Local<v8::FunctionTemplate> hClass =
+        v8::Local<v8::FunctionTemplate>::New(
+            lpClass->GetContext()->GetRuntime(), lpClass->GetTemplate());
+    if (!hClass->HasInstance(hObject)) {
+      return NULL;
+    }
+  }
   return hObject->GetAlignedPointerFromInternalField(0);
 }