Merge 99311 - [V8] Null out V8NPObject::rootObject when the owning

Source/WebCore/bindings/v8/V8Helpers.cpp

Index: Source/WebCore/bindings/v8/V8Helpers.cpp
===================================================================
--- Source/WebCore/bindings/v8/V8Helpers.cpp	(revision 99451)
+++ Source/WebCore/bindings/v8/V8Helpers.cpp	(working copy)
@@ -32,6 +32,7 @@
 #include "V8Helpers.h"
 
 #include "DOMWindow.h"
+#include "Frame.h"
 #include "NPV8Object.h"
 #include "V8Proxy.h"
 
@@ -40,6 +41,9 @@
 v8::Local<v8::Context> toV8Context(NPP npp, NPObject* npObject)
 {
     V8NPObject* object = reinterpret_cast<V8NPObject*>(npObject);
+    DOMWindow* domWindow = object->rootObject;
+    if (!domWindow || domWindow != domWindow->frame()->domWindow())
+        return v8::Local<v8::Context>();
     return V8Proxy::mainWorldContext(object->rootObject->frame());
 }