Add an extra guard to replaceDocument()

Source/bindings/core/v8/ScriptController.cpp

 /*
  * Copyright (C) 2008, 2009 Google Inc. All rights reserved.
  * Copyright (C) 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2014 Opera Software ASA. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
@@ skipping 540 matching lines @@
 
     if (result.IsEmpty() || !result->IsString())
         return true;
     String scriptResult = toCoreString(v8::Handle<v8::String>::Cast(result));
 
     // We're still in a frame, so there should be a DocumentLoader.
     ASSERT(m_frame->document()->loader());
     if (!locationChangeBefore && m_frame->navigationScheduler().locationChangePending())
         return true;
 
-    // DocumentWriter::replaceDocument can cause the DocumentLoader to get deref'ed and possible destroyed,
-    // so protect it with a RefPtr.
-    if (RefPtr<DocumentLoader> loader = m_frame->document()->loader()) {
-        UseCounter::count(*m_frame->document(), UseCounter::ReplaceDocumentViaJavaScriptURL);
-        loader->replaceDocument(scriptResult, ownerDocument.get());
-    }
+    m_frame->loader().replaceDocument(scriptResult, ownerDocument.get());
     return true;
 }
 
 void ScriptController::executeScriptInMainWorld(const String& script, ExecuteScriptPolicy policy)
 {
     v8::HandleScope handleScope(m_isolate);
     evaluateScriptInMainWorld(ScriptSourceCode(script), NotSharableCrossOrigin, policy);
 }
 
 void ScriptController::executeScriptInMainWorld(const ScriptSourceCode& sourceCode, AccessControlStatus corsStatus)
@@ skipping 61 matching lines @@
         resultArray->Set(i, evaluationResult);
     }
 
     if (results) {
         for (size_t i = 0; i < resultArray->Length(); ++i)
             results->append(handleScope.Escape(resultArray->Get(i)));
     }
 }
 
 } // namespace blink