Merge 157914 "Prevent crash due to XMLDocumentParser destruction"

Source/core/xml/parser/XMLDocumentParser.cpp

 /*
  * Copyright (C) 2000 Peter Kelly (pmk@post.com)
  * Copyright (C) 2005, 2006, 2008 Apple Inc. All rights reserved.
  * Copyright (C) 2006 Alexey Proskuryakov (ap@webkit.org)
  * Copyright (C) 2007 Samuel Weinig (sam@webkit.org)
  * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
  * Copyright (C) 2008 Holger Hans Peter Freyther
  * Copyright (C) 2008 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  *
  * This library is free software; you can redistribute it and/or
@@ skipping 331 matching lines @@
         m_originalSourceForTransform.append(source);
 
     if (isStopped() || m_sawXSLTransform)
         return;
 
     if (m_parserPaused) {
         m_pendingSrc.append(source);
         return;
     }
 
+    // JavaScript can detach the parser. Make sure this is not released
+    // before the end of this method.
+    RefPtr<XMLDocumentParser> protect(this);
+
     doWrite(source.toString());
 
     if (isStopped())
         return;
 
     if (document()->frame() && document()->frame()->script()->canExecuteScripts(NotAboutToExecuteScript))
         ImageLoader::dispatchPendingBeforeLoadEvents();
 }
 
 void XMLDocumentParser::handleError(XMLErrors::ErrorType type, const char* formattedMessage, TextPosition position)
@@ skipping 1254 matching lines @@
     sax.initialized = XML_SAX2_MAGIC;
     RefPtr<XMLParserContext> parser = XMLParserContext::createStringParser(&sax, &state);
     String parseString = "<?xml version=\"1.0\"?><attrs " + string + " />";
     parseChunk(parser->context(), parseString);
     finishParsing(parser->context());
     attrsOK = state.gotAttributes;
     return state.attributes;
 }
 
 } // namespace WebCore