Add a test that confirms there's no crash on accessing properties of AccesibilityObject at the init…

LayoutTests/fast/dom/Window/resources/window-property-collector.js

 function collectProperties()
 {
     // Collect properties of the top-level window, since touching the properties
     // of a DOMWindow affects its internal C++ state.
     collectPropertiesHelper(window, []);
 
     propertiesToVerify.sort(function (a, b)
     {
         if (a.property < b.property)
             return -1
@@ skipping 60 matching lines @@
 
 function collectPropertiesHelper(object, path)
 {
     if (path.length > 20)
         throw 'Error: probably looping';
 
     for (var property in object) {
         // Skip the properties which are hard to expect a stable result.
         // As for 'accessibilityController', we can hardly estimate the states
         // of the cached WebAXObjects.
-        // FIXME: We can't access accessibilityController's properties here

[dmazzoni, 2014/03/28 06:30:32]

It looks like you're deleting the FIXME, but the step that skips
accessibilityController is still there

[hajimehoshi, 2014/03/28 07:23:46]

Done.

-        // because some property accesses might crash (crbug/351195).
         if (property == 'accessibilityController')
             continue;
         // As for 'localStorage', local storage is not reliably cleared between tests.
         if (property == 'localStorage')
             continue;
         path.push(property);
         var type = typeof(object[property]);
         if (type == "object") {
             if (object[property] === null) {
                 emitExpectedResult(path, "null");
             } else if (!object[property].Window
                 && !(object[property] instanceof Node)
                 && !(object[property] instanceof MimeTypeArray)
                 && !(object[property] instanceof PluginArray)) {
                 // Skip some traversing through types that will end up in cycles...
                 collectPropertiesHelper(object[property], path);
             }
         } else if (type == "string") {
             emitExpectedResult(path, "''");
         } else if (type == "number") {
             emitExpectedResult(path, "0");
         } else if (type == "boolean") {
             emitExpectedResult(path, "false");
         }
         path.pop();
     }
 }