Merge 93732

Source/WebKit/mac/WebView/WebFrame.mm

 /*
  * Copyright (C) 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  *
  * 1.  Redistributions of source code must retain the above copyright
  *     notice, this list of conditions and the following disclaimer. 
  * 2.  Redistributions in binary form must reproduce the above copyright
@@ skipping 590 matching lines @@
 }
 
 - (NSString *)_stringByEvaluatingJavaScriptFromString:(NSString *)string
 {
     return [self _stringByEvaluatingJavaScriptFromString:string forceUserGesture:true];
 }
 
 - (NSString *)_stringByEvaluatingJavaScriptFromString:(NSString *)string forceUserGesture:(BOOL)forceUserGesture
 {
     ASSERT(_private->coreFrame->document());
+    RetainPtr<WebFrame> protect(self); // Executing arbitrary JavaScript can destroy the frame.
     
     JSValue result = _private->coreFrame->script()->executeScript(string, forceUserGesture).jsValue();
 
     if (!_private->coreFrame) // In case the script removed our frame from the page.
         return @"";
 
     // This bizarre set of rules matches behavior from WebKit for Safari 2.0.
     // If you don't like it, use -[WebScriptObject evaluateWebScript:] or 
     // JSEvaluateScript instead, since they have less surprising semantics.
     if (!result || (!result.isBoolean() && !result.isString() && !result.isNumber()))
@@ skipping 576 matching lines @@
     JSDOMWindow* anyWorldGlobalObject = _private->coreFrame->script()->globalObject(mainThreadNormalWorld());
 
     // The global object is probably a shell object? - if so, we know how to use this!
     JSC::JSObject* globalObjectObj = toJS(globalObjectRef);
     if (!strcmp(globalObjectObj->classInfo()->className, "JSDOMWindowShell"))
         anyWorldGlobalObject = static_cast<JSDOMWindowShell*>(globalObjectObj)->window();
 
     // Get the frame frome the global object we've settled on.
     Frame* frame = anyWorldGlobalObject->impl()->frame();
     ASSERT(frame->document());
+    RetainPtr<WebFrame> webFrame(kit(frame)); // Running arbitrary JavaScript can destroy the frame.
+
     JSValue result = frame->script()->executeScriptInWorld(core(world), string, true).jsValue();
 
-    if (!frame) // In case the script removed our frame from the page.
+    if (!webFrame->_private->coreFrame) // In case the script removed our frame from the page.
         return @"";
 
     // This bizarre set of rules matches behavior from WebKit for Safari 2.0.
     // If you don't like it, use -[WebScriptObject evaluateWebScript:] or 
     // JSEvaluateScript instead, since they have less surprising semantics.
     if (!result || (!result.isBoolean() && !result.isString() && !result.isNumber()))
         return @"";
 
     JSLock lock(SilenceAssertionsOnly);
     return ustringToString(result.toString(anyWorldGlobalObject->globalExec()));
@@ skipping 374 matching lines @@
 
 - (JSGlobalContextRef)globalContext
 {
     Frame* coreFrame = _private->coreFrame;
     if (!coreFrame)
         return 0;
     return toGlobalRef(coreFrame->script()->globalObject(mainThreadNormalWorld())->globalExec());
 }
 
 @end