Oilpan: move DOMWindow object to the oilpan heap.

Source/bindings/v8/WrapperTypeInfo.h

 /*
  * Copyright (C) 2010 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 174 matching lines @@
         // Persistent handle is stored in the last internal field.
         return static_cast<PersistentNode*>(wrapper->GetAlignedPointerFromInternalField(wrapper->InternalFieldCount() - 1));
     }
 
     inline void releaseObject(v8::Handle<v8::Object> wrapper)
     {
         const WrapperTypeInfo* typeInfo = toWrapperTypeInfo(wrapper);
 #if ENABLE(OILPAN)
         if (typeInfo->isGarbageCollected) {
             const PersistentNode* handle = toPersistentHandle(wrapper);
-            ASSERT(handle);
+            // This will be null iff a wrapper for a hidden wrapper object,
+            // see V8DOMWrapper::setNativeInfoForHiddenWrapper().
             delete handle;
         } else {
             ASSERT(typeInfo->derefObjectFunction);
             typeInfo->derefObjectFunction(toNative(wrapper));
         }
 #else
         ASSERT(typeInfo->derefObjectFunction);
         typeInfo->derefObjectFunction(toNative(wrapper));
 #endif
     }
@@ skipping 22 matching lines @@
     }
 
     inline WrapperConfiguration buildWrapperConfiguration(Node*, WrapperConfiguration::Lifetime lifetime)
     {
         WrapperConfiguration configuration = {v8DOMNodeClassId, lifetime};
         return configuration;
     }
 }
 
 #endif // WrapperTypeInfo_h