This is a facepalm bug... A fix will come shortly.
Created attachment 192131 [details] Patch
Committed r145175: <http://trac.webkit.org/changeset/145175>
Comment on attachment 192131 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=192131&action=review > Source/WebCore/bindings/v8/V8AdaptorFunction.cpp:79 > - v8::Handle<v8::Function> adaptor = v8::Handle<v8::Function>::Cast(getTemplate(isolate, worldType(isolate))->GetFunction()); > + v8::Handle<v8::Function> adaptor = v8::Handle<v8::Function>::Cast(getTemplate(isolate, worldType(isolate))->GetFunction()->Clone()); Sorry for missing this in the review.
(In reply to comment #3) > > Sorry for missing this in the review. Well, the test should have been more comprehensive.