https://bugs.webkit.org/show_bug.cgi?id=93654

Reviewed by Eric Seidel.

Source/WebCore:

When wrapping a Document, we need to ensure that the global object for
the wrapper actually exists before trying to create the wrapper. In
other cases in the DOM, we always touch the global object before trying
to wrap a given DOM object. For Document, however,
HTMLFrameElement.contentDocument is a rare way to get at a DOM object
for a global object without first touching the Window object.

Rather than writing custom bindings for
HTMLFrameElement.contentDocument, this patch just makes toJS for
Document ensure that toJS for DOMWindow has been called first. The V8
bindings have some similar code.

Test: fast/dom/content-document-prototype.html

* bindings/js/JSDocumentCustom.cpp:
(WebCore::toJS):

LayoutTests:

* fast/dom/content-document-prototype-expected.txt: Added.
* fast/dom/content-document-prototype.html: Added.
    - Check that HTMLFrameElement.contentDocument ends up with the
      right prototype chain. This is a tricky case because not only the
      prototype chain of the property different from the holder, we
      never actually touch the DOMWindow in this test case so the
      prototype chain leads to a global object that doesn't even exist
      yet!
* fast/events/keyevent-iframe-removed-crash.html:
    - Add a call to gc() so that this test will ASSERT reliabily if we
      cause a similar problem in the future.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@128513 268f45cc-cd09-0410-ab3c-d52691b4dbfc