Merge Webkit at r58956: Initial merge by Git.

Change-Id: I1d9fb60ea2c3f2ddc04c17a871acdb39353be228

1 files changed, 6 insertions, 1 deletions

diff --git a/WebCore/bindings/v8/V8GCController.cpp b/WebCore/bindings/v8/V8GCController.cpp
index 61b2a88..fa7c357 100644
--- a/WebCore/bindings/v8/V8GCController.cpp
+++ b/WebCore/bindings/v8/V8GCController.cpp
@@ -378,7 +378,12 @@ public:
             ActiveDOMObject* activeDOMObject = typeInfo->toActiveDOMObject(wrapper);
             if (activeDOMObject && activeDOMObject->hasPendingActivity()) {
                 ASSERT(!wrapper.IsWeak());
-                wrapper.MakeWeak(activeDOMObject, &DOMDataStore::weakActiveDOMObjectCallback);
+                // NOTE: To re-enable weak status of the active object we use
+                // |object| from the map and not |activeDOMObject|. The latter
+                // may be a different pointer (in case ActiveDOMObject is not
+                // the main base class of the object's class) and pointer
+                // identity is required by DOM map functions.
+                wrapper.MakeWeak(object, &DOMDataStore::weakActiveDOMObjectCallback);
             }
         }
     }