When a page is unloaded the JS listener destructor might be called without an active context. See http//crbug.com/24200.
Created attachment 40943 [details] patch
Created attachment 40944 [details] patch
CCing reviewers who know v8.
Comment on attachment 40944 [details] patch Clearing flags on attachment: 40944 Committed r49429: <http://trac.webkit.org/changeset/49429>
All reviewed patches have been landed. Closing bug.
Has this been tested? It broke the following layout tests across all platforms: LayoutTests/fast/dom/onload-open.html = CRASH LayoutTests/fast/dom/resource-locations-in-created-html-document.html = CRASH LayoutTests/fast/events/invalid-001.html = CRASH LayoutTests/fast/events/keypress-focus-change.html = CRASH LayoutTests/fast/events/mouseover-mouseout.html = CRASH LayoutTests/fast/events/mouseover-mouseout2.html = CRASH LayoutTests/http/tests/loading/gmail-assert-on-load.html = CRASH LayoutTests/http/tests/xmlhttprequest/frame-unload-abort-crash.html = CRASH LayoutTests/http/tests/xmlhttprequest/web-apps/012.html = CRASH LayoutTests/http/tests/xmlhttprequest/xmlhttprequest-image-not-loaded-svg.svg = CRASH LayoutTests/svg/custom/js-update-transform-changes.svg = CRASH Can we please, please test before submitting changes? Rolled out in http://trac.webkit.org/changeset/49473.
Closing some V8-related work items.