[Binding] Do not install document into hidden Window object

third_party/WebKit/Source/bindings/core/v8/WindowProxy.cpp

 /*
  * Copyright (C) 2008, 2009, 2011 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 413 matching lines @@
         return;
     ASSERT(documentWrapper == m_document.newLocal(m_isolate) || m_document.isEmpty());
     if (m_document.isEmpty())
         updateDocumentWrapper(v8::Local<v8::Object>::Cast(documentWrapper));
     checkDocumentWrapper(m_document.newLocal(m_isolate), frame->document());
 
     ASSERT(documentWrapper->IsObject());
     // TODO(jochen): Don't replace the accessor with a data value. We need a way to tell v8 that the accessor's return value won't change after this point.
     if (!v8CallBoolean(context->Global()->ForceSet(context, v8AtomicString(m_isolate, "document"), documentWrapper, static_cast<v8::PropertyAttribute>(v8::ReadOnly | v8::DontDelete))))
         return;
-
-    // We also stash a reference to the document on the inner global object so that
-    // LocalDOMWindow objects we obtain from JavaScript references are guaranteed to have
-    // live Document objects.
-    V8HiddenValue::setHiddenValue(m_scriptState.get(), toInnerGlobalObject(context), V8HiddenValue::document(m_isolate), documentWrapper);
 }
 
 void WindowProxy::updateActivityLogger()
 {
     m_scriptState->perContextData()->setActivityLogger(V8DOMActivityLogger::activityLogger(
         m_world->worldId(), m_frame->isLocalFrame() && toLocalFrame(m_frame)->document() ? toLocalFrame(m_frame)->document()->baseURI() : KURL()));
 }
 
 void WindowProxy::setSecurityToken(SecurityOrigin* origin)
 {
@@ skipping 130 matching lines @@
 }
 
 void WindowProxy::updateSecurityOrigin(SecurityOrigin* origin)
 {
     if (!isContextInitialized())
         return;
     setSecurityToken(origin);
 }
 
 } // namespace blink