From 8a0914b749bbe7da7768e07a7db5c6d4bb09472b Mon Sep 17 00:00:00 2001
From: Steve Block <steveblock@google.com>
Date: Mon, 15 Feb 2010 12:23:52 +0000
Subject: Merge webkit.org at r54731 : Initial merge by git

Change-Id: Ia79977b6cf3b0b00c06ef39419989b28e57e4f4a
---
 WebCore/bindings/js/ScriptObject.cpp | 4 ++++
 1 file changed, 4 insertions(+)

(limited to 'WebCore/bindings/js/ScriptObject.cpp')

diff --git a/WebCore/bindings/js/ScriptObject.cpp b/WebCore/bindings/js/ScriptObject.cpp
index 03ecfc6..7948219 100644
--- a/WebCore/bindings/js/ScriptObject.cpp
+++ b/WebCore/bindings/js/ScriptObject.cpp
@@ -70,6 +70,10 @@ bool ScriptObject::set(const String& name, const String& value)
 
 bool ScriptObject::set(const char* name, const ScriptObject& value)
 {
+    if (value.scriptState() != m_scriptState) {
+        ASSERT_NOT_REACHED();
+        return false;
+    }
     JSLock lock(SilenceAssertionsOnly);
     PutPropertySlot slot;
     jsObject()->put(m_scriptState, Identifier(m_scriptState, name), value.jsObject(), slot);
-- 
cgit v1.1