Merge 163680 "Fix a crash when a form control is in a past naems..."

Source/core/html/FormAssociatedElement.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
  * Copyright (C) 2004, 2005, 2006, 2007 Apple Inc. All rights reserved.
  *           (C) 2006 Alexey Proskuryakov (ap@nypop.com)
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
@@ skipping 104 matching lines @@
 
     if (!currentAssociatedForm)
         return element->findFormAncestor();
 
     return currentAssociatedForm;
 }
 
 void FormAssociatedElement::formRemovedFromTree(const Node* formRoot)
 {
     ASSERT(m_form);
-    if (toHTMLElement(this)->highestAncestor() != formRoot)
-        setForm(0);
+    if (toHTMLElement(this)->highestAncestor() == formRoot)
+        return;
+    RefPtr<HTMLElement> protector(toHTMLElement(this));
+    setForm(0);
 }
 
 void FormAssociatedElement::setForm(HTMLFormElement* newForm)
 {
     if (m_form == newForm)
         return;
     willChangeForm();
     if (m_form)
         m_form->removeFormElement(this);
     m_form = newForm;
@@ skipping 160 matching lines @@
     , m_element(element)
 {
 }
 
 void FormAttributeTargetObserver::idTargetChanged()
 {
     m_element->formAttributeTargetChanged();
 }
 
 } // namespace Webcore