From 678de4acf72e6fd4c6fb9426d2c69445acc18135 Mon Sep 17 00:00:00 2001
From: Ben Murdoch <benm@google.com>
Date: Wed, 30 May 2012 16:07:49 +0100
Subject: Fix document.createTouchList crash.

Cherry pick of WebKit r119158.

Note the layout test is tweaked slighly from upstream to make it
happy in our older webkit snapshot.

See: http://trac.webkit.org/changeset/119158

Bug: 6578213

Change-Id: Id6cc23938b5139cf0416e3d4c6e7ba227b1b6a0c
---
 Source/WebCore/bindings/v8/custom/V8DocumentCustom.cpp | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

(limited to 'Source/WebCore/bindings/v8')

diff --git a/Source/WebCore/bindings/v8/custom/V8DocumentCustom.cpp b/Source/WebCore/bindings/v8/custom/V8DocumentCustom.cpp
index 7cad58e..d142a9f 100644
--- a/Source/WebCore/bindings/v8/custom/V8DocumentCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8DocumentCustom.cpp
@@ -43,6 +43,7 @@
 #include "V8CanvasRenderingContext2D.h"
 #include "V8CustomXPathNSResolver.h"
 #include "V8DOMImplementation.h"
+#include "V8DOMWrapper.h"
 #include "V8HTMLDocument.h"
 #include "V8IsolatedContext.h"
 #include "V8Node.h"
@@ -144,9 +145,8 @@ v8::Handle<v8::Value> V8Document::createTouchListCallback(const v8::Arguments& a
     RefPtr<TouchList> touchList = TouchList::create();
 
     for (int i = 0; i < args.Length(); i++) {
-        if (!args[i]->IsObject())
-            return v8::Undefined();
-        touchList->append(V8Touch::toNative(args[i]->ToObject()));
+        Touch* touch = V8DOMWrapper::isWrapperOfType(args[i], &V8Touch::info) ? V8Touch::toNative(args[i]->ToObject()) : 0;
+        touchList->append(touch);
     }
 
     return toV8(touchList.release());
-- 
cgit v1.1