A patch for http://crbug.com/17400...

bindings/v8/V8Utilities.cpp

 /*
  * Copyright (C) 2008, 2009 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 49 matching lines @@
     v8::Local<v8::Value> cache = object->GetInternalField(cacheIndex);
     ASSERT(cache->IsArray());
     v8::Local<v8::Array> cacheArray = v8::Local<v8::Array>::Cast(cache);
     for (int i = cacheArray->Length() - 1; i >= 0; --i) {
         v8::Local<v8::Value> cached = cacheArray->Get(v8::Integer::New(i));
         if (cached->StrictEquals(value)) {
             cacheArray->Delete(i);
             return;
         }
     }
-
-    // We should only get here if we try to remove an event listener that was never added.
-    ASSERT_NOT_REACHED();
 }
 
 bool processingUserGesture()
 {
     Frame* frame = V8Proxy::retrieveFrameForEnteredContext();
     return frame && frame->script()->processingUserGesture();
 }
 
 bool shouldAllowNavigation(Frame* frame)
 {
@@ skipping 14 matching lines @@
 {
     Frame* callingFrame = V8Proxy::retrieveFrameForCallingContext();
     if (!callingFrame)
         return;
 
     if (!protocolIsJavaScript(url) || ScriptController::isSafeScript(frame))
         frame->loader()->scheduleLocationChange(url.string(), callingFrame->loader()->outgoingReferrer(), lockHistory, lockBackForwardList, processingUserGesture());
 }
 
 } // namespace WebCore