This is a cleaned up fix of Christian's original patch in ...

webkit/port/bindings/v8/v8_proxy.h

 // Copyright (c) 2006-2008 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef V8_PROXY_H__
 #define V8_PROXY_H__
 
 #include <v8.h>
 #include "v8_index.h"
 #include "v8_custom.h"
@@ skipping 220 matching lines @@
   // Run an already compiled script.
   v8::Local<v8::Value> RunScript(v8::Handle<v8::Script> script,
                                  bool inline_code);
 
   // Call the function with the given receiver and arguments.
   v8::Local<v8::Value> CallFunction(v8::Handle<v8::Function> function,
                                     v8::Handle<v8::Object> receiver,
                                     int argc,
                                     v8::Handle<v8::Value> argv[]);
 
+  // Returns the dom constructor function for the given node type.
+  v8::Local<v8::Function> GetConstructor(V8ClassIndex::V8WrapperType type);
+
   // Returns the window object of the currently executing context.
   static DOMWindow* retrieveWindow();
   // Returns the window object associated with a context.
   static DOMWindow* retrieveWindow(v8::Handle<v8::Context> context);
   // Returns V8Proxy object of the currently executing context.
   static V8Proxy* retrieve();
   // Returns V8Proxy object associated with a frame.
   static V8Proxy* retrieve(Frame* frame);
   // Returns V8Proxy object associated with a script execution context.
   static V8Proxy* retrieve(ScriptExecutionContext* context);
@@ skipping 169 matching lines @@
   // Check whether a V8 value is a wrapper of type |classType|.
   static bool IsWrapperOfType(v8::Handle<v8::Value> obj,
                               V8ClassIndex::V8WrapperType classType);
 
  private:
   void initContextIfNeeded();
   void DisconnectEventListeners();
   void SetSecurityToken();
   void ClearDocumentWrapper();
   void UpdateDocumentWrapper(v8::Handle<v8::Value> wrapper);
+  // Dispose global handles of m_contexts and friends.
+  void DisposeContext();
 
   static bool CanAccessPrivate(DOMWindow* target);
 
   // Check whether a V8 value is a DOM Event wrapper
   static bool IsDOMEventWrapper(v8::Handle<v8::Value> obj);
 
   static void* ToNativeObjectImpl(V8ClassIndex::V8WrapperType type,
                                   v8::Handle<v8::Value> object);
 
   // Take C pointer out of a v8 wrapper
@@ skipping 49 matching lines @@
   static V8ClassIndex::V8WrapperType GetSVGElementType(SVGElement* elm);
   static const char* GetSVGExceptionName(int exception_code);
 #endif
 
   // Returns a local handle of the context.
   v8::Local<v8::Context> GetContext() {
     return v8::Local<v8::Context>::New(m_context);
   }
 
   Frame* m_frame;
+
   v8::Persistent<v8::Context> m_context;
+  // DOM constructors are cached per context. A DOM constructor is a function
+  // instance created from a DOM constructor template. There is one instance
+  // per context. A DOM constructor is different from a normal function in
+  // two ways: 1) it cannot be called as constructor (aka, used to create
+  // a DOM object); 2) its __proto__ points to Object.prototype rather than
+  // Function.prototype. The reason for 2) is that, in Safari, a DOM constructor
+  // is a normal JS object, but not a function. Hotmail relies on the fact
+  // that, in Safari, HTMLElement.__proto__ == Object.prototype.
+  //
+  // m_object_prototype is a cache of the original Object.prototype.
+  //
+  // Both handles must be disposed when the context is disposed. Otherwise,
+  // it can keep all objects alive.
+  v8::Persistent<v8::Array> m_dom_constructor_cache;
+  v8::Persistent<v8::Value> m_object_prototype;
+  
   v8::Persistent<v8::Object> m_global;
-
   v8::Persistent<v8::Value> m_document;
 
   int m_handlerLineno;
 
   // A list of event listeners created for this frame,
   // the list gets cleared when removing all timeouts.
   V8EventListenerList m_event_listeners;
 
   // A list of event listeners create for XMLHttpRequest object for this frame,
   // the list gets cleared when removing all timeouts.
@@ skipping 29 matching lines @@
   obj->ref();
   V8Proxy::SetJSWrapperForDOMObject(
       obj.get(), v8::Persistent<v8::Object>::New(args.Holder()));
   return args.Holder();
 }
 
 }  // namespace WebCore
 
 #endif  // V8_PROXY_H__