NPObject should not be retrieved as ScriptWrappable

third_party/WebKit/Source/bindings/core/v8/V8NPObject.cpp

 /*
 * Copyright (C) 2006, 2007, 2008, 2009 Google Inc. All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions are
 * met:
 *
 *     * Redistributions of source code must retain the above copyright
 * notice, this list of conditions and the following disclaimer.
 *     * Redistributions in binary form must reproduce the above
@@ skipping 464 matching lines @@
     // Use V8DOMWrapper::createWrapper() and
     // V8DOMWrapper::associateObjectWithWrapper()
     // to create a wrapper object.
     v8::Local<v8::Function> v8Function;
     if (!npObjectDesc.Get(isolate)->GetFunction(isolate->GetCurrentContext()).ToLocal(&v8Function))
         return v8::Local<v8::Object>();
     v8::Local<v8::Object> value;
     if (!V8ObjectConstructor::newInstance(isolate, v8Function).ToLocal(&value))
         return v8::Local<v8::Object>();
 
-    V8DOMWrapper::setNativeInfo(value, npObjectTypeInfo(), npObjectToScriptWrappable(object));
+    // NPObject is not ScriptWrappable. We must not retrieve the pointer as
+    // ScriptWrappable.
+    V8DOMWrapper::setNativeInfo(value, npObjectTypeInfo(), reinterpret_cast<ScriptWrappable*>(object));
 
     // KJS retains the object as part of its wrapper (see Bindings::CInstance).
     _NPN_RetainObject(object);
     _NPN_RegisterObject(object, root);
 
     bool wrapperDidNotExist = staticNPObjectMap().set(object, npObjectTypeInfo(), value);
     ASSERT_UNUSED(wrapperDidNotExist, wrapperDidNotExist);
     ASSERT(V8DOMWrapper::hasInternalFieldsSet(value));
     return value;
 }
 
 void forgetV8ObjectForNPObject(NPObject* object)
 {
     v8::Isolate* isolate = v8::Isolate::GetCurrent();
     v8::HandleScope scope(isolate);
     v8::Local<v8::Object> wrapper = staticNPObjectMap().newLocal(isolate, object);
     if (!wrapper.IsEmpty()) {
         V8DOMWrapper::clearNativeInfo(wrapper, npObjectTypeInfo());
         staticNPObjectMap().removeAndDispose(object);
         _NPN_ReleaseObject(object);
     }
 }
 
 } // namespace blink