[webkit-reviews] review granted: [Bug 101917] [V8] Replace setDOMWrapper() + setJSWrapperForDOMObject() with createDOMWrapper() : [Attachment 174081] Fixed crashes

[bugzilla-daemon at webkit.org]

Adam Barth <abarth at webkit.org> has granted Kentaro Hara
<haraken at chromium.org>'s request for review:
Bug 101917: [V8] Replace setDOMWrapper() + setJSWrapperForDOMObject() with
createDOMWrapper()
https://bugs.webkit.org/show_bug.cgi?id=101917

Attachment 174081: Fixed crashes
https://bugs.webkit.org/attachment.cgi?id=174081&action=review

------- Additional Comments from Adam Barth <abarth at webkit.org>
View in context: https://bugs.webkit.org/attachment.cgi?id=174081&action=review


LGTM, assuming the tests pass.

> Source/WebCore/bindings/v8/custom/V8HTMLDocumentCustom.cpp:78
>      shadow->SetPrototype(wrapper);

I looked into this shadow object, by the way.  It's needed to support a corner
case in document.all.  If the web site sets document.all to some object, that
object is stored in the shadow object so that when the property is deleted, the
native document.all can re-appear.