https://bugs.webkit.org/show_bug.cgi?id=94060

Reviewed by Kentaro Hara.

Source/WebCore:

Previously, the V8 garbage collector might have collected the Document
wrapper before the DOMWindow wrapper because we overwrite the
"document" property of the DOMWindow during navigation.

This patch adds a hidden document property on the global object to
ensure that the Document wrapper lives at least as long as the
DOMWindow wrapper, ensuring that DOMWindows that we obtain from V8
always have non-null Document objects.

The JavaScriptCore bindings already have this behavior.

Test: fast/dom/Window/dom-access-from-closure-window-with-gc.html

* bindings/v8/V8DOMWindowShell.cpp:
(WebCore::V8DOMWindowShell::updateDocumentWrapperCache):
* bindings/v8/V8HiddenPropertyName.h:
(WebCore):

LayoutTests:

Ensure that collecting garbage doesn't change the behavior of this test
(compared with dom-access-from-closure-window.html).

* fast/dom/Window/dom-access-from-closure-window-with-gc-expected.txt: Added.
* fast/dom/Window/dom-access-from-closure-window-with-gc.html: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@125656 268f45cc-cd09-0410-ab3c-d52691b4dbfc