Let's try this again. The regressions were caused by an incorrect use...

webkit/port/bindings/v8/v8_custom.cpp

 /*
  *  Copyright (C) 2000 Harri Porten (porten@kde.org)
  *  Copyright (C) 2001 Peter Kelly (pmk@post.com)
  *  Copyright (C) 2004-2006 Apple Computer, Inc.
  *  Copyright (C) 2006 James G. Speth (speth@end.com)
  *  Copyright (C) 2006 Samuel Weinig (sam@webkit.org)
  *  Copyright 2007, 2008 Google Inc. All Rights Reserved.
  *
  *  This library is free software; you can redistribute it and/or
  *  modify it under the terms of the GNU Lesser General Public
@@ skipping 2582 matching lines @@
   String str = "";
   for (int i = 0; i < args.Length(); ++i) {
     str += ToWebCoreString(args[i]);
   }
   return str;
 }
 
 CALLBACK_FUNC_DECL(HTMLDocumentWrite) {
   INC_STATS(L"DOM.HTMLDocument.write()");
   HTMLDocument* imp = V8Proxy::DOMWrapperToNode<HTMLDocument>(args.Holder());
-  imp->write(WriteHelper_GetString(args),
-             V8Proxy::retrieveWindow()->document());
+  Frame* frame = V8Proxy::retrieveActiveFrame();
+  ASSERT(frame);
+  imp->write(WriteHelper_GetString(args), frame->document());
   return v8::Undefined();
 }
 
 CALLBACK_FUNC_DECL(HTMLDocumentWriteln) {
   INC_STATS(L"DOM.HTMLDocument.writeln()");
   HTMLDocument* imp = V8Proxy::DOMWrapperToNode<HTMLDocument>(args.Holder());
-  imp->writeln(WriteHelper_GetString(args),
-               V8Proxy::retrieveWindow()->document());
+  Frame* frame = V8Proxy::retrieveActiveFrame();
+  ASSERT(frame);
+  imp->writeln(WriteHelper_GetString(args), frame->document());
   return v8::Undefined();
 }
 
 CALLBACK_FUNC_DECL(HTMLDocumentOpen) {
   INC_STATS(L"DOM.HTMLDocument.open()");
   HTMLDocument* imp = V8Proxy::DOMWrapperToNode<HTMLDocument>(args.Holder());
 
   if (args.Length() > 2) {
     if (Frame* frame = imp->frame()) {
       // Fetch the global object for the frame.
@@ skipping 851 matching lines @@
 #undef MAKE_CASE
 
   default:
     return V8ClassIndex::INVALID_CLASS_INDEX;
   }
 }
 
 #endif  // ENABLE(SVG)
 
 }  // namespace WebCore