Merge 95667 - [Chromium] Protect the Frame in V8HTMLDocument::openCallback

Source/WebCore/bindings/v8/custom/V8HTMLDocumentCustom.cpp

Index: Source/WebCore/bindings/v8/custom/V8HTMLDocumentCustom.cpp
===================================================================
--- Source/WebCore/bindings/v8/custom/V8HTMLDocumentCustom.cpp	(revision 95975)
+++ Source/WebCore/bindings/v8/custom/V8HTMLDocumentCustom.cpp	(working copy)
@@ -132,9 +132,9 @@
     HTMLDocument* htmlDocument = V8HTMLDocument::toNative(args.Holder());
 
     if (args.Length() > 2) {
-        if (Frame* frame = htmlDocument->frame()) {
+        if (RefPtr<Frame> frame = htmlDocument->frame()) {
             // Fetch the global object for the frame.
-            v8::Local<v8::Context> context = V8Proxy::context(frame);
+            v8::Local<v8::Context> context = V8Proxy::context(frame.get());
             // Bail out if we cannot get the context.
             if (context.IsEmpty())
                 return v8::Undefined();
@@ -151,8 +151,9 @@
             for (int i = 0; i < args.Length(); i++)
                 params[i] = args[i];
 
-            V8Proxy* proxy = V8Proxy::retrieve(frame);
-            ASSERT(proxy);
+            V8Proxy* proxy = V8Proxy::retrieve(frame.get());
+            if (!proxy)
+                return v8::Undefined();
 
             v8::Local<v8::Value> result = proxy->callFunction(v8::Local<v8::Function>::Cast(function), global, args.Length(), params);
             delete[] params;