6 files changed, 21 insertions, 10 deletions
diff --git a/xfa/fxjse/cfxjse_arguments.h b/xfa/fxjse/cfxjse_arguments.h
index d7b6734e14..423e22d888 100644
--- a/xfa/fxjse/cfxjse_arguments.h
+++ b/xfa/fxjse/cfxjse_arguments.h
@@ -18,7 +18,7 @@ class CFXJSE_Arguments {
   int32_t GetInt32(int32_t index) const;
   FX_FLOAT GetFloat(int32_t index) const;
   CFX_ByteString GetUTF8String(int32_t index) const;
-  void* GetObject(int32_t index) const;
+  void* GetObject(int32_t index, FXJSE_HCLASS hClass = nullptr) const;
   FXJSE_HVALUE GetReturnValue();
 };
 
diff --git a/xfa/fxjse/class.cpp b/xfa/fxjse/class.cpp
index 18c542a65e..ff5990aa85 100644
--- a/xfa/fxjse/class.cpp
+++ b/xfa/fxjse/class.cpp
@@ -183,7 +183,7 @@ CFX_ByteString CFXJSE_Arguments::GetUTF8String(int32_t index) const {
   return CFX_ByteString(*szStringVal);
 }
 
-void* CFXJSE_Arguments::GetObject(int32_t index) const {
+void* CFXJSE_Arguments::GetObject(int32_t index, FXJSE_HCLASS hClass) const {
   const CFXJSE_ArgumentsImpl* lpArguments =
       reinterpret_cast<const CFXJSE_ArgumentsImpl* const>(this);
   v8::Local<v8::Value> hValue = (*lpArguments->m_pInfo)[index];
@@ -191,7 +191,8 @@ void* CFXJSE_Arguments::GetObject(int32_t index) const {
   if (!hValue->IsObject()) {
     return NULL;
   }
-  return FXJSE_RetrieveObjectBinding(hValue.As<v8::Object>());
+  CFXJSE_Class* lpClass = reinterpret_cast<CFXJSE_Class*>(hClass);
+  return FXJSE_RetrieveObjectBinding(hValue.As<v8::Object>(), lpClass);
 }
 
 FXJSE_HVALUE CFXJSE_Arguments::GetReturnValue() {
diff --git a/xfa/fxjse/include/fxjse.h b/xfa/fxjse/include/fxjse.h
index fce1b969fb..d009372c54 100644
--- a/xfa/fxjse/include/fxjse.h
+++ b/xfa/fxjse/include/fxjse.h
@@ -103,7 +103,7 @@ FX_FLOAT FXJSE_Value_ToFloat(FXJSE_HVALUE hValue);
 double FXJSE_Value_ToDouble(FXJSE_HVALUE hValue);
 int32_t FXJSE_Value_ToInteger(FXJSE_HVALUE hValue);
 void FXJSE_Value_ToUTF8String(FXJSE_HVALUE hValue, CFX_ByteString& szStrOutput);
-void* FXJSE_Value_ToObject(FXJSE_HVALUE hValue);
+void* FXJSE_Value_ToObject(FXJSE_HVALUE hValue, FXJSE_HCLASS hClass);
 
 void FXJSE_Value_SetUndefined(FXJSE_HVALUE hValue);
 void FXJSE_Value_SetNull(FXJSE_HVALUE hValue);
diff --git a/xfa/fxjse/util_inline.h b/xfa/fxjse/util_inline.h
index 336886b666..e61dc6aa80 100644
--- a/xfa/fxjse/util_inline.h
+++ b/xfa/fxjse/util_inline.h
@@ -20,7 +20,8 @@ static V8_INLINE void FXJSE_UpdateObjectBinding(v8::Local<v8::Object>& hObject,
   hObject->SetAlignedPointerInInternalField(0, lpNewBinding);
 }
 static V8_INLINE void* FXJSE_RetrieveObjectBinding(
-    const v8::Local<v8::Object>& hJSObject) {
+    const v8::Local<v8::Object>& hJSObject,
+    CFXJSE_Class* lpClass = NULL) {
   ASSERT(!hJSObject.IsEmpty());
   if (!hJSObject->IsObject()) {
     return NULL;
@@ -36,6 +37,14 @@ static V8_INLINE void* FXJSE_RetrieveObjectBinding(
       return NULL;
     }
   }
+  if (lpClass) {
+    v8::Local<v8::FunctionTemplate> hClass =
+        v8::Local<v8::FunctionTemplate>::New(
+            lpClass->GetContext()->GetRuntime(), lpClass->GetTemplate());
+    if (!hClass->HasInstance(hObject)) {
+      return NULL;
+    }
+  }
   return hObject->GetAlignedPointerFromInternalField(0);
 }
 
diff --git a/xfa/fxjse/value.cpp b/xfa/fxjse/value.cpp
index d3366cf08e..c23e12c32f 100644
--- a/xfa/fxjse/value.cpp
+++ b/xfa/fxjse/value.cpp
@@ -72,8 +72,9 @@ int32_t FXJSE_Value_ToInteger(FXJSE_HVALUE hValue) {
   return reinterpret_cast<CFXJSE_Value*>(hValue)->ToInteger();
 }
 
-void* FXJSE_Value_ToObject(FXJSE_HVALUE hValue) {
-  return reinterpret_cast<CFXJSE_Value*>(hValue)->ToObject();
+void* FXJSE_Value_ToObject(FXJSE_HVALUE hValue, FXJSE_HCLASS hClass) {
+  CFXJSE_Class* lpClass = reinterpret_cast<CFXJSE_Class*>(hClass);
+  return reinterpret_cast<CFXJSE_Value*>(hValue)->ToObject(lpClass);
 }
 
 void FXJSE_Value_SetUndefined(FXJSE_HVALUE hValue) {
@@ -237,7 +238,7 @@ CFXJSE_Value* CFXJSE_Value::Create(v8::Isolate* pIsolate) {
   return new CFXJSE_Value(pIsolate);
 }
 
-void* CFXJSE_Value::ToObject() const {
+void* CFXJSE_Value::ToObject(CFXJSE_Class* lpClass) const {
   ASSERT(!m_hValue.IsEmpty());
 
   CFXJSE_ScopeUtil_IsolateHandleRootContext scope(m_pIsolate);
@@ -247,7 +248,7 @@ void* CFXJSE_Value::ToObject() const {
   if (!hValue->IsObject())
     return nullptr;
 
-  return FXJSE_RetrieveObjectBinding(hValue.As<v8::Object>());
+  return FXJSE_RetrieveObjectBinding(hValue.As<v8::Object>(), lpClass);
 }
 
 V8_INLINE static double FXJSE_ftod(FX_FLOAT fNumber) {
diff --git a/xfa/fxjse/value.h b/xfa/fxjse/value.h
index 12db5883cf..2939ac34f7 100644
--- a/xfa/fxjse/value.h
+++ b/xfa/fxjse/value.h
@@ -148,7 +148,7 @@ class CFXJSE_Value {
     v8::String::Utf8Value hStringVal(hString);
     szStrOutput = *hStringVal;
   }
-  void* ToObject() const;
+  void* ToObject(CFXJSE_Class* lpClass) const;
 
  public:
   V8_INLINE void SetUndefined() {