Merge 94820 - REGRESSION (r66874): Missing RefPtr in ScriptController

Source/WebCore/bindings/ScriptControllerBase.cpp

 /*
  *  Copyright (C) 1999-2001 Harri Porten (porten@kde.org)
  *  Copyright (C) 2001 Peter Kelly (pmk@post.com)
  *  Copyright (C) 2006, 2007, 2008 Apple Inc. All rights reserved.
  *
  *  This library is free software; you can redistribute it and/or
  *  modify it under the terms of the GNU Lesser General Public
  *  License as published by the Free Software Foundation; either
  *  version 2 of the License, or (at your option) any later version.
  *
@@ skipping 49 matching lines @@
 }
 
 ScriptValue ScriptController::executeScript(const ScriptSourceCode& sourceCode)
 {
     if (!canExecuteScripts(AboutToExecuteScript) || isPaused())
         return ScriptValue();
 
     bool wasInExecuteScript = m_inExecuteScript;
     m_inExecuteScript = true;
 
+    RefPtr<Frame> protect(m_frame); // Script execution can destroy the frame, and thus the ScriptController.
+
     ScriptValue result = evaluate(sourceCode);
 
     if (!wasInExecuteScript) {
         m_inExecuteScript = false;
         Document::updateStyleForAllDocuments();
     }
 
     return result;
 }
 
@@ skipping 42 matching lines @@
         
         // DocumentWriter::replaceDocument can cause the DocumentLoader to get deref'ed and possible destroyed,
         // so protect it with a RefPtr.
         if (RefPtr<DocumentLoader> loader = m_frame->document()->loader())
             loader->writer()->replaceDocument(scriptResult);
     }
     return true;
 }
 
 } // namespace WebCore