When unwrapping NPObjects to native Ranges and Elements, the Chromium WebKit API should check that the wrapped object is indeed that type.
Created attachment 90289 [details] Patch
Comment on attachment 90289 [details] Patch <3
Comment on attachment 90289 [details] Patch Clearing flags on attachment: 90289 Committed r84328: <http://trac.webkit.org/changeset/84328>
All reviewed patches have been landed. Closing bug.