[webkit-reviews] review granted: [Bug 30137] [V8] Protect JS listener object from GC while clearing a property on it. : [Attachment 40745] patch

[bugzilla-daemon at webkit.org]

Adam Barth <abarth at webkit.org> has granted Vitaly Repeshko
<vitalyr at chromium.org>'s request for review:
Bug 30137: [V8] Protect JS listener object from GC while clearing a property on
it.
https://bugs.webkit.org/show_bug.cgi?id=30137

Attachment 40745: patch
https://bugs.webkit.org/attachment.cgi?id=40745&action=review

------- Additional Comments from Adam Barth <abarth at webkit.org>
I don't see how this is possible to test.  We'd need to force GC during the
clearWrapper call, but I don't think that re-enters JavaScript....  Thoughts?