Merge 94237

Source/WebKit/chromium/src/FrameLoaderClientImpl.cpp

 /*
  * Copyright (C) 2009 Google Inc. All rights reserved.
  * Copyright (C) 2011 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
@@ skipping 263 matching lines @@
     // FIXME
 }
 
 void FrameLoaderClientImpl::detachedFromParent2()
 {
     // Nothing to do here.
 }
 
 void FrameLoaderClientImpl::detachedFromParent3()
 {
+    // If we were reading data into a plugin, drop our reference to it. If we
+    // don't do this then it may end up out-living the rest of the page, which
+    // leads to problems if the plugin's destructor tries to script things.
+    m_pluginWidget = 0;
+
     // Close down the proxy.  The purpose of this change is to make the
     // call to ScriptController::clearWindowShell a no-op when called from
     // Frame::pageDestroyed.  Without this change, this call to clearWindowShell
     // will cause a crash.  If you remove/modify this, just ensure that you can
     // go to a page and then navigate to a new page without getting any asserts
     // or crashes.
     m_webFrame->frame()->script()->proxy()->clearForClose();
 
     // Alert the client that the frame is being detached. This is the last
     // chance we have to communicate with the client.
@@ skipping 1306 matching lines @@
     }
     return ds->releasePluginLoadObserver();
 }
 
 PassRefPtr<FrameNetworkingContext> FrameLoaderClientImpl::createNetworkingContext()
 {
     return FrameNetworkingContextImpl::create(m_webFrame->frame());
 }
 
 } // namespace WebKit