Merge from Chromium at DEPS revision 262940

This commit was generated by merge_to_master.py.

Change-Id: I767658f35150c8e0099156a5a5daf4bdf7e8ae0f
diff --git a/Source/bindings/v8/V8NPObject.cpp b/Source/bindings/v8/V8NPObject.cpp
index a3f8ab7..2062e8c 100644
--- a/Source/bindings/v8/V8NPObject.cpp
+++ b/Source/bindings/v8/V8NPObject.cpp
@@ -36,7 +36,6 @@
 #include "V8HTMLEmbedElement.h"
 #include "V8HTMLObjectElement.h"
 #include "bindings/v8/NPV8Object.h"
-#include "bindings/v8/UnsafePersistent.h"
 #include "bindings/v8/V8Binding.h"
 #include "bindings/v8/V8NPUtils.h"
 #include "bindings/v8/V8ObjectConstructor.h"
@@ -404,18 +403,13 @@
     return npObjectMap;
 }
 
-template<>
-inline void DOMWrapperMap<NPObject>::setWeakCallback(const v8::WeakCallbackData<v8::Object, DOMWrapperMap<NPObject> >& data)
+template <>
+inline void DOMWrapperMap<NPObject>::PersistentValueMapTraits::Dispose(
+    v8::Isolate* isolate,
+    v8::UniquePersistent<v8::Object> value,
+    NPObject* npObject)
 {
-    NPObject* npObject = static_cast<NPObject*>(toNative(data.GetValue()));
-
     ASSERT(npObject);
-    ASSERT(staticNPObjectMap().containsKeyAndValue(npObject, data.GetValue()));
-
-    // Must remove from our map before calling _NPN_ReleaseObject(). _NPN_ReleaseObject can
-    // call forgetV8ObjectForNPObject, which uses the table as well.
-    staticNPObjectMap().removeAndDispose(npObject);
-
     if (_NPN_IsAlive(npObject))
         _NPN_ReleaseObject(npObject);
 }
@@ -453,7 +447,7 @@
     // V8DOMWrapper::associateObjectWithWrapper()
     // to create a wrapper object.
     v8::Handle<v8::Function> v8Function = npObjectDesc.Get(isolate)->GetFunction();
-    v8::Local<v8::Object> value = V8ObjectConstructor::newInstance(v8Function);
+    v8::Local<v8::Object> value = V8ObjectConstructor::newInstance(isolate, v8Function);
     if (value.IsEmpty())
         return value;