Finalization is no longer eager, just like destruction, so the original intent behind this ASSERT in ~JSNPObject is no longer relevant. Therefore, we can remove all destruction-related stuff from JSNPObject.
Created attachment 161551 [details] Patch
http://trac.webkit.org/changeset/121316 is the change that caused this new behavior. It was meant to remove this ASSERT, but it was overlooked.
Comment on attachment 161551 [details] Patch Still need a destructor so we don't leak the np object.
Created attachment 161558 [details] Patch
Comment on attachment 161558 [details] Patch r=me
Comment on attachment 161558 [details] Patch Clearing flags on attachment: 161558 Committed r127219: <http://trac.webkit.org/changeset/127219>
All reviewed patches have been landed. Closing bug.