Merge 129962 - REGRESSION(r122215) - CachedImage::likelyToBeUsedSoon crashes on accessing a deleted…

Source/WebCore/platform/chromium/ClipboardChromium.cpp

 /*
  * Copyright (C) 2006, 2007 Apple Inc.  All rights reserved.
  * Copyright (C) 2008, 2009 Google Inc.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
@@ skipping 209 matching lines @@
                                      ClipboardAccessPolicy policy,
                                      Frame* frame)
     : Clipboard(policy, clipboardType)
     , m_dataObject(dataObject)
     , m_frame(frame)
 {
 }
 
 ClipboardChromium::~ClipboardChromium()
 {
+    if (m_dragImage)
+        m_dragImage->removeClient(this);
 }
 
 PassRefPtr<ClipboardChromium> ClipboardChromium::create(ClipboardType clipboardType,
     PassRefPtr<ChromiumDataObject> dataObject, ClipboardAccessPolicy policy, Frame* frame)
 {
     return adoptRef(new ClipboardChromium(clipboardType, dataObject, policy, frame));
 }
 
 void ClipboardChromium::clearData(const String& type)
 {
@@ skipping 218 matching lines @@
 PassRefPtr<DataTransferItemList> ClipboardChromium::items()
 {
     // FIXME: According to the spec, we are supposed to return the same collection of items each
     // time. We now return a wrapper that always wraps the *same* set of items, so JS shouldn't be
     // able to tell, but we probably still want to fix this.
     return DataTransferItemListPolicyWrapper::create(this, m_dataObject);
 }
 #endif
 
 } // namespace WebCore