Merge 94721 - FrameLoader::addExtraFieldsToRequest can crash when called from or after FrameLoade...

Source/WebKit/chromium/src/WebPluginContainerImpl.cpp

 /*
  * Copyright (C) 2009 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 368 matching lines @@
 
     // Failure is reported as a null string.
     String resultStr;
     result.getString(resultStr);
     return resultStr;
 }
 
 void WebPluginContainerImpl::loadFrameRequest(const WebURLRequest& request, const WebString& target, bool notifyNeeded, void* notifyData)
 {
     Frame* frame = m_element->document()->frame();
-    if (!frame)
+    if (!frame || !frame->loader()->documentLoader())
         return;  // FIXME: send a notification in this case?
 
     if (notifyNeeded) {
         // FIXME: This is a bit of hack to allow us to observe completion of
         // our frame request.  It would be better to evolve FrameLoader to
         // support a completion callback instead.
         OwnPtr<WebPluginLoadObserver> observer = adoptPtr(new WebPluginLoadObserver(this, request.url(), notifyData));
         // FIXME: Calling get here is dangerous! What if observer is freed?
         m_pluginLoadObservers.append(observer.get());
         WebDataSourceImpl::setNextPluginLoadObserver(observer.release());
@@ skipping 242 matching lines @@
         // frame view.
         RenderLayer* layer = m_element->renderer()->enclosingLayer();
         clipRect.intersect(
             m_element->document()->view()->windowClipRectForLayer(layer, true));
     }
 
     return clipRect;
 }
 
 } // namespace WebKit