Merge 95204 - 2011-09-15 James Simonsen <simonjam@chromium.org>

Source/WebCore/html/HTMLObjectElement.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2000 Stefan Schimanski (1Stein@gmx.de)
  * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009, 2011 Apple Inc. All rights reserved.
  * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
@@ skipping 311 matching lines @@
     bool beforeLoadAllowedLoad = dispatchBeforeLoadEvent(url);
     m_inBeforeLoadEventHandler = false;
 
     // beforeload events can modify the DOM, potentially causing
     // RenderWidget::destroy() to be called.  Ensure we haven't been
     // destroyed before continuing.
     // FIXME: Should this render fallback content?
     if (!renderer())
         return;
 
+    RefPtr<HTMLObjectElement> protect(this); // Loading the plugin might remove us from the document.
     SubframeLoader* loader = document()->frame()->loader()->subframeLoader();
     bool success = beforeLoadAllowedLoad && hasValidClassId() && loader->requestObject(this, url, getAttribute(nameAttr), serviceType, paramNames, paramValues);
 
     if (!success && fallbackContent)
         renderFallbackContent();
 }
 
 bool HTMLObjectElement::rendererIsNeeded(const NodeRenderingContext& context)
 {
     // FIXME: This check should not be needed, detached documents never render!
@@ skipping 215 matching lines @@
 {
     return m_name.isNull() ? emptyAtom : m_name;
 }
 
 HTMLFormElement* HTMLObjectElement::virtualForm() const
 {
     return FormAssociatedElement::form();
 }
 
 }