Merge 158428 "Fix a crash in HTMLFormElement::prepareForSubmission."

Source/core/html/HTMLFormElement.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
  * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  *           (C) 2006 Alexey Proskuryakov (ap@nypop.com)
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
@@ skipping 240 matching lines @@
             String message("An invalid form control with name='%name' is not focusable.");
             message.replace("%name", unhandledAssociatedElement->name());
             document().addConsoleMessage(RenderingMessageSource, ErrorMessageLevel, message);
         }
     }
     return false;
 }
 
 bool HTMLFormElement::prepareForSubmission(Event* event)
 {
+    RefPtr<HTMLFormElement> protector(this);
     Frame* frame = document().frame();
     if (m_isSubmittingOrPreparingForSubmission || !frame)
         return m_isSubmittingOrPreparingForSubmission;
 
     m_isSubmittingOrPreparingForSubmission = true;
     m_shouldSubmit = false;
 
     // Interactive validation must be done before dispatching the submit event.
     if (!validateInteractively(event)) {
         m_isSubmittingOrPreparingForSubmission = false;
@@ skipping 515 matching lines @@
 }
 
 void HTMLFormElement::setDemoted(bool demoted)
 {
     if (demoted)
         UseCounter::count(&document(), UseCounter::DemotedFormElement);
     m_wasDemoted = demoted;
 }
 
 } // namespace