Merge 146344 "[v8] unsafe persistent access in V8LazyEventListener"

Source/WebCore/bindings/v8/V8LazyEventListener.cpp

 /*
  * Copyright (C) 2006, 2007, 2008, 2009 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 52 matching lines @@
 }
 
 template<typename T>
 v8::Handle<v8::Object> toObjectWrapper(T* domObject, v8::Isolate* isolate)
 {
     if (!domObject)
         return v8::Object::New();
     v8::Handle<v8::Value> value = toV8(domObject, v8::Handle<v8::Object>(), isolate);
     if (value.IsEmpty())
         return v8::Object::New();
-    return value.As<v8::Object>();
+    return v8::Local<v8::Object>::New(isolate, value.As<v8::Object>());
 }
 
 v8::Local<v8::Value> V8LazyEventListener::callListenerFunction(ScriptExecutionContext* context, v8::Handle<v8::Value> jsEvent, Event* event)
 {
     v8::Local<v8::Object> listenerObject = getListenerObject(context);
     if (listenerObject.IsEmpty())
         return v8::Local<v8::Value>();
 
     v8::Local<v8::Function> handlerFunction = listenerObject.As<v8::Function>();
     v8::Local<v8::Object> receiver = getReceiverObject(context, event);
@@ skipping 154 matching lines @@
     // // Since we only parse once, there's no need to keep data used for parsing around anymore.
     // m_functionName = String();
     // m_code = String();
     // m_eventParameterName = String();
     // m_sourceURL = String();
 
     setListenerObject(wrappedFunction);
 }
 
 } // namespace WebCore