Fix for http://code.google.com/p/chromium/issues/detail?id=5409....

webkit/port/bindings/v8/v8_npobject.cpp

 // Copyright (c) 2008, Google Inc.
 // All rights reserved.
 // 
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 // 
 //     * Redistributions of source code must retain the above copyright
 // notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
@@ skipping 11 matching lines @@
 // OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
 // SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
 // LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
 // DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
 // THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 #include "config.h"
 
+#include "v8_custom.h"
 #include "v8_helpers.h"
 #include "v8_npobject.h"
 #include "v8_np_utils.h"
 #include "np_v8object.h"
 #include "npruntime_priv.h"
 #include "v8_proxy.h"
 #include "dom_wrapper_map.h"
 #include "HTMLPlugInElement.h"
 #include "V8HTMLAppletElement.h"
 #include "V8HTMLEmbedElement.h"
@@ skipping 23 matching lines @@
     if (script_instance) {
       npobject = V8Proxy::ToNativeObject<NPObject>(
           V8ClassIndex::NPOBJECT, script_instance->instance());
     } else {
       npobject = NULL;
     }
 
   } else {
     // The holder object is not a subtype of HTMLPlugInElement, it
     // must be an NPObject which has three internal fields.
-    if (args.Holder()->InternalFieldCount() != 3) {
+    if (args.Holder()->InternalFieldCount() !=
+            V8Custom::kNPObjectInternalFieldCount) {
       V8Proxy::ThrowError(V8Proxy::REFERENCE_ERROR,
                           "NPMethod called on non-NPObject");
       return v8::Undefined();
     }
     npobject = V8Proxy::ToNativeObject<NPObject>(
         V8ClassIndex::NPOBJECT, args.Holder());
   }
 
   // Verify that our wrapper wasn't using a NPObject which
   // has already been deleted.
@@ skipping 236 matching lines @@
     return v8::Local<v8::Object>::New(static_npobject_map.get(object));
 
   // TODO: we should create a Wrapper type as a subclass of JSObject.
   // It has two internal fields, field 0 is the wrapped pointer,
   // and field 1 is the type. There should be an api function that
   // returns unused type id.
   // The same Wrapper type can be used by DOM bindings.
   if (np_object_desc.IsEmpty()) {
     np_object_desc =
         v8::Persistent<v8::FunctionTemplate>::New(v8::FunctionTemplate::New());
-    np_object_desc->InstanceTemplate()->SetInternalFieldCount(3);
+    np_object_desc->InstanceTemplate()->SetInternalFieldCount(
+        V8Custom::kNPObjectInternalFieldCount);
     np_object_desc->InstanceTemplate()->SetNamedPropertyHandler(
         NPObjectNamedPropertyGetter, NPObjectNamedPropertySetter);
     np_object_desc->InstanceTemplate()->SetIndexedPropertyHandler(
         NPObjectIndexedPropertyGetter, NPObjectIndexedPropertySetter);
     np_object_desc->InstanceTemplate()->SetCallAsFunctionHandler(
         NPObjectInvokeDefaultHandler); 
   }
 
   v8::Handle<v8::Function> func = np_object_desc->GetFunction();
   v8::Local<v8::Object> value = SafeAllocation::NewInstance(func);
@@ skipping 20 matching lines @@
 void ForgetV8ObjectForNPObject(NPObject* object) {
   if (static_npobject_map.contains(object)) {
     v8::HandleScope scope;
     v8::Persistent<v8::Object> handle(static_npobject_map.get(object));
     WebCore::V8Proxy::SetDOMWrapper(handle,
         WebCore::V8ClassIndex::NPOBJECT, NULL);
     static_npobject_map.forget(object);
     NPN_ReleaseObject(object);
   }
 }