Index: third_party/WebKit/Source/bindings/core/v8/V8NPObject.cpp |
diff --git a/third_party/WebKit/Source/bindings/core/v8/V8NPObject.cpp b/third_party/WebKit/Source/bindings/core/v8/V8NPObject.cpp |
index cc8ff429f2e55eb5a248503d2291b610ebaf06d8..97205ecc8594f0f297aad9205c8aceef01da0261 100644 |
--- a/third_party/WebKit/Source/bindings/core/v8/V8NPObject.cpp |
+++ b/third_party/WebKit/Source/bindings/core/v8/V8NPObject.cpp |
@@ -482,7 +482,9 @@ v8::Local<v8::Object> createV8ObjectForNPObject(v8::Isolate* isolate, NPObject* |
if (!V8ObjectConstructor::newInstance(isolate, v8Function).ToLocal(&value)) |
return v8::Local<v8::Object>(); |
- V8DOMWrapper::setNativeInfo(value, npObjectTypeInfo(), npObjectToScriptWrappable(object)); |
+ // NPObject is not ScriptWrappable. We must not retrieve the pointer as |
+ // ScriptWrappable. |
+ V8DOMWrapper::setNativeInfo(value, npObjectTypeInfo(), reinterpret_cast<ScriptWrappable*>(object)); |
// KJS retains the object as part of its wrapper (see Bindings::CInstance). |
_NPN_RetainObject(object); |