Remove leak of objects between isolated worlds on custom events.

Source/bindings/v8/custom/V8PopStateEventCustom.cpp

 /*
  * Copyright (C) 2010 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 38 matching lines @@
 void V8PopStateEvent::stateAttrGetterCustom(v8::Local<v8::String> name, const v8::PropertyCallbackInfo<v8::Value>& info)
 {
     v8::Handle<v8::Value> result = info.Holder()->GetHiddenValue(V8HiddenPropertyName::state());
 
     if (!result.IsEmpty()) {
         v8SetReturnValue(info, result);
         return;
     }
 
     PopStateEvent* event = V8PopStateEvent::toNative(info.Holder());
-    if (!event->state().hasNoValue()) {
-        v8SetReturnValue(info, cacheState(info.Holder(), event->state().v8Value()));
+
+    // This is necessary because of the V8 bug 2746. V8 returns an empty
+    // handler when a hidden value is v8::Undefined. Thus, it is necessary to
+    // keep extra state around in the event about whether the value was set in
+    // the first place. That is, if the detail was set, and V8 returns an empty
+    // handler for the value, we know that the value must actually be a
+    // v8::Undefined(), so we explicitly set that here. Oy!
+    //
+    // Once bug 2746 is addressed, the following 'if' should become dead code
+    // and should be removable. Please see the related comments in
+    // V8CustomEventCustom.cpp and V8MessageEventCustom.cpp as well.
+    if (event->isStateSet()) {
+        v8SetReturnValue(info, v8::Undefined());
         return;
     }
 
     History* history = event->history();
     if (!history || !event->serializedState()) {
         v8SetReturnValue(info, cacheState(info.Holder(), v8Null(info.GetIsolate())));
         return;
     }
 
     // There's no cached value from a previous invocation, nor a state value was provided by the
@@ skipping 15 matching lines @@
         }
         result = event->serializedState()->deserialize(info.GetIsolate());
         v8History->SetHiddenValue(V8HiddenPropertyName::state(), result);
     } else
         result = event->serializedState()->deserialize(info.GetIsolate());
 
     v8SetReturnValue(info, cacheState(info.Holder(), result));
 }
 
 } // namespace WebCore