Merge 95667 - [Chromium] Protect the Frame in V8HTMLDocument::openCallback

Source/WebCore/bindings/v8/custom/V8HTMLDocumentCustom.cpp

 /*
  * Copyright (C) 2007, 2008, 2009 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 114 matching lines @@
     htmlDocument->writeln(writeHelperGetString(args), frame ? frame->document() : NULL);
     return v8::Undefined();
 }
 
 v8::Handle<v8::Value> V8HTMLDocument::openCallback(const v8::Arguments& args)
 {
     INC_STATS("DOM.HTMLDocument.open()");
     HTMLDocument* htmlDocument = V8HTMLDocument::toNative(args.Holder());
 
     if (args.Length() > 2) {
-        if (Frame* frame = htmlDocument->frame()) {
+        if (RefPtr<Frame> frame = htmlDocument->frame()) {
             // Fetch the global object for the frame.
-            v8::Local<v8::Context> context = V8Proxy::context(frame);
+            v8::Local<v8::Context> context = V8Proxy::context(frame.get());
             // Bail out if we cannot get the context.
             if (context.IsEmpty())
                 return v8::Undefined();
             v8::Local<v8::Object> global = context->Global();
             // Get the open property of the global object.
             v8::Local<v8::Value> function = global->Get(v8::String::New("open"));
             // If the open property is not a function throw a type error.
             if (!function->IsFunction()) {
                 throwError("open is not a function");
                 return v8::Undefined();
             }
             // Wrap up the arguments and call the function.
             v8::Local<v8::Value>* params = new v8::Local<v8::Value>[args.Length()];
             for (int i = 0; i < args.Length(); i++)
                 params[i] = args[i];
 
-            V8Proxy* proxy = V8Proxy::retrieve(frame);
-            ASSERT(proxy);
+            V8Proxy* proxy = V8Proxy::retrieve(frame.get());
+            if (!proxy)
+                return v8::Undefined();
 
             v8::Local<v8::Value> result = proxy->callFunction(v8::Local<v8::Function>::Cast(function), global, args.Length(), params);
             delete[] params;
             return result;
         }
     }
 
     Frame* frame = V8Proxy::retrieveFrameForCallingContext();
     htmlDocument->open(frame ? frame->document() : NULL);
     // Return the document.
@@ skipping 22 matching lines @@
     if (wrapper.IsEmpty())
         return wrapper;
     if (!V8IsolatedContext::getEntered()) {
         if (V8Proxy* proxy = V8Proxy::retrieve(impl->frame()))
             proxy->windowShell()->updateDocumentWrapper(wrapper);
     }
     return wrapper;
 }
 
 } // namespace WebCore