Merge 96991 - https://bugs.webkit.org/show_bug.cgi?id=69471

Source/WebCore/bindings/v8/ScriptController.h

Index: Source/WebCore/bindings/v8/ScriptController.h
===================================================================
--- Source/WebCore/bindings/v8/ScriptController.h	(revision 97018)
+++ Source/WebCore/bindings/v8/ScriptController.h	(working copy)
@@ -208,7 +208,14 @@
     // The frame keeps a NPObject reference for each item on the list.
     PluginObjectMap m_pluginObjects;
 #if ENABLE(NETSCAPE_PLUGIN_API)
-    NPObject* m_windowScriptNPObject;
+    // The window script object can get destroyed while there are outstanding
+    // references to it. Please refer to ScriptController::clearScriptObjects
+    // for more information as to why this is necessary. To avoid crashes due
+    // to calls on the destroyed window object, we return a proxy NPObject
+    // which wraps the underlying window object. The wrapped window object
+    // pointer in this object is cleared out when the window object is
+    // destroyed.
+    NPObject* m_wrappedWindowScriptNPObject;
 #endif
 };