Add 'error' parameter to 'window.onerror' and 'ErrorEvent'.

The HTML5 spec recently added the error object to both the
'window.onerror' callback and the 'ErrorEvent' interface in order to
improve developers' ability to debug issues that cause unexpected
exceptions in the wild[1]. This patch brings Blink's behavior into line
with that update.

Currently, we generate an ErrorEvent object after doing sanitization.
This patch refactors that code such that we generate an ErrorEvent when
V8 calls back into the bindings (V8Initializer::messageHandlerInWorker
and V8Initializer::messageHandlerInMainThread). Before we hand that
event off to core for sanitization and dispatch, we grab the wrapper
for the world in which the exception was thrown, and set the exception
object as a hidden value (V8HiddenPropertyName::error()).

On the other end, we grab that exception object in the custom 'error'
getter of 'V8ErrorEvent', and when triggering the 'onerror' handler
via 'V8ErrorHandler::callListenerFunction'. If the value exists, we're
still in the same isolated world, so we can safely return the exception
without leakage. If the value is empty, we've crossed worlds, and
return 'null' instead.

BUG=147127

Review URL: https://chromiumcodereview.appspot.com/20351002

git-svn-id: svn://svn.chromium.org/blink/trunk@155454 bbb929c8-8fbe-4397-9dbb-9b2b20218538