Unwrap function before calling IsConstructor

IsConstructor returns true for all wrappers that are callable. Wrapped
arrow functions are callable and thus IsConstructor will return true
if given one; however, if we unwrap the arrow function, IsConstructor
will return false. The latter is the correct behavior here.

components/script/dom/customelementregistry.rs

@@ -26,6 +26,7 @@ use dom::window::Window;
 use dom_struct::dom_struct;
 use html5ever::{LocalName, Namespace, Prefix};
 use js::conversions::ToJSValConvertible;
+use js::glue::UnwrapObject;
 use js::jsapi::{Construct1, IsCallable, IsConstructor, HandleValueArray, HandleObject, MutableHandleValue};
 use js::jsapi::{Heap, JS_GetProperty, JSAutoCompartment, JSContext};
 use js::jsval::{JSVal, NullValue, ObjectValue, UndefinedValue};
@@ -193,7 +194,15 @@ impl CustomElementRegistryMethods for CustomElementRegistry {
         let name = LocalName::from(&*name);
 
         // Step 1
-        if unsafe { !IsConstructor(constructor.get()) } {
+        // We must unwrap the constructor as all wrappers are constructable if they are callable.
+        rooted!(in(cx) let unwrapped_constructor = unsafe { UnwrapObject(constructor.get(), 1) });
+
+        if unwrapped_constructor.is_null() {
+            // We do not have permission to access the unwrapped constructor.
+            return Err(Error::Security);
+        }
+
+        if unsafe { !IsConstructor(unwrapped_constructor.get()) } {
             return Err(Error::Type("Second argument of CustomElementRegistry.define is not a constructor".to_owned()));
         }
 

tests/wpt/metadata/custom-elements/custom-element-registry/define.html.ini

@@ -1,5 +0,0 @@
-[define.html]
-  type: testharness
-  [If constructor is arrow function, should throw a TypeError]
-    expected: FAIL
-