Merge 137964

Merge 137964
> Regression causing DOM objects to have unstable NPObject* references with v8 bindings
> https://bugs.webkit.org/show_bug.cgi?id=104921
> 
> Source/WebCore:
> 
> Patch by Matthew Dempsky <mdempsky@google.com>; on 2012-12-17
> Reviewed by Kentaro Hara.
> 
> Fix regression introduced by changeset 135804 resulting in
> unstable NPObject* references for v8 objects.  In the iter !=
> v8NPObjectMap->end() code path, objectVector was left unassigned
> if the for loop terminated without returning.
> 
> Also, V8Object::GetIdentityHash() is documented as not being guaranteed
> as unique.  As such, don't ASSERT() that two objects with the same hash
> must therefor be the same object.
> 
> Tests: plugins/npruntime/embed-property-iframe-equality.html
> 
> * bindings/v8/NPV8Object.cpp:
> (WebCore::npCreateV8ScriptObject): Fix.
> 
> LayoutTests:
> 
> Patch by Mathew Dempsky <mdempsky@google.com>; on 2012-12-17
> Reviewed by Kentaro Hara.
> 
> Add variant of embed-property-equality test to verify that the
> test still passes when the object being tested for equality
> has already been remembered by a plugin from a different
> JavaScript context.
> 
> * plugins/npruntime/embed-property-iframe-equality.html: Added.
> * plugins/npruntime/embed-property-iframe-equality-expected.txt: Added.

TBR=commit-queue@webkit.org
Committed: https://src.chromium.org/viewvc/chrome?view=rev&revision=138940