1 files changed, 24 insertions, 18 deletions

diff --git a/chromium/third_party/WebKit/Source/bindings/v8/V8NodeFilterCondition.cpp b/chromium/third_party/WebKit/Source/bindings/v8/V8NodeFilterCondition.cpp
index 3fcbc3c0f94..deecfa7b5c6 100644
--- a/chromium/third_party/WebKit/Source/bindings/v8/V8NodeFilterCondition.cpp
+++ b/chromium/third_party/WebKit/Source/bindings/v8/V8NodeFilterCondition.cpp
@@ -31,35 +31,41 @@
 #include "config.h"
 #include "bindings/v8/V8NodeFilterCondition.h"
 
-#include "V8Node.h"
+#include "bindings/core/v8/V8Node.h"
 #include "bindings/v8/ScriptController.h"
-#include "bindings/v8/ScriptState.h"
-#include "bindings/v8/V8HiddenPropertyName.h"
+#include "bindings/v8/V8HiddenValue.h"
 #include "core/dom/Node.h"
 #include "core/dom/NodeFilter.h"
 #include "wtf/OwnPtr.h"
 
 namespace WebCore {
 
-V8NodeFilterCondition::V8NodeFilterCondition(v8::Handle<v8::Value> filter, v8::Handle<v8::Object> owner, v8::Isolate* isolate)
-    : m_filter(isolate, filter)
+V8NodeFilterCondition::V8NodeFilterCondition(v8::Handle<v8::Value> filter, v8::Handle<v8::Object> owner, ScriptState* scriptState)
+    : m_scriptState(scriptState)
 {
-    owner->SetHiddenValue(V8HiddenPropertyName::condition(isolate), filter);
-    m_filter.setWeak(this, &setWeakCallback);
+    // ..acceptNode(..) will only dispatch m_filter if m_filter->IsObject().
+    // We'll make sure m_filter is either usable by acceptNode or empty.
+    // (See the fast/dom/node-filter-gc test for a case where 'empty' happens.)
+    if (!filter.IsEmpty() && filter->IsObject()) {
+        V8HiddenValue::setHiddenValue(scriptState->isolate(), owner, V8HiddenValue::condition(scriptState->isolate()), filter);
+        m_filter.set(scriptState->isolate(), filter);
+        m_filter.setWeak(this, &setWeakCallback);
+    }
 }
 
 V8NodeFilterCondition::~V8NodeFilterCondition()
 {
 }
 
-short V8NodeFilterCondition::acceptNode(ScriptState* state, Node* node) const
+short V8NodeFilterCondition::acceptNode(Node* node, ExceptionState& exceptionState) const
 {
-    v8::Isolate* isolate = state->isolate();
-    ASSERT(isolate->InContext());
+    v8::Isolate* isolate = m_scriptState->isolate();
+    ASSERT(!m_scriptState->context().IsEmpty());
     v8::HandleScope handleScope(isolate);
     v8::Handle<v8::Value> filter = m_filter.newLocal(isolate);
-    ASSERT(!filter.IsEmpty());
-    if (!filter->IsObject())
+
+    ASSERT(filter.IsEmpty() || filter->IsObject());
+    if (filter.IsEmpty())
         return NodeFilter::FILTER_ACCEPT;
 
     v8::TryCatch exceptionCatcher;
@@ -69,21 +75,21 @@ short V8NodeFilterCondition::acceptNode(ScriptState* state, Node* node) const
         callback = v8::Handle<v8::Function>::Cast(filter);
     else {
         v8::Local<v8::Value> value = filter->ToObject()->Get(v8AtomicString(isolate, "acceptNode"));
-        if (!value->IsFunction()) {
-            throwTypeError("NodeFilter object does not have an acceptNode function", state->isolate());
+        if (value.IsEmpty() || !value->IsFunction()) {
+            exceptionState.throwTypeError("NodeFilter object does not have an acceptNode function");
             return NodeFilter::FILTER_REJECT;
         }
         callback = v8::Handle<v8::Function>::Cast(value);
     }
 
     OwnPtr<v8::Handle<v8::Value>[]> info = adoptArrayPtr(new v8::Handle<v8::Value>[1]);
-    info[0] = toV8(node, v8::Handle<v8::Object>(), state->isolate());
+    v8::Handle<v8::Object> context = m_scriptState->context()->Global();
+    info[0] = toV8(node, context, isolate);
 
-    v8::Handle<v8::Object> object = isolate->GetCurrentContext()->Global();
-    v8::Handle<v8::Value> result = ScriptController::callFunction(state->executionContext(), callback, object, 1, info.get(), isolate);
+    v8::Handle<v8::Value> result = ScriptController::callFunction(m_scriptState->executionContext(), callback, context, 1, info.get(), isolate);
 
     if (exceptionCatcher.HasCaught()) {
-        state->setException(exceptionCatcher.Exception());
+        exceptionState.rethrowV8Exception(exceptionCatcher.Exception());
         return NodeFilter::FILTER_REJECT;
     }