Merge 96991 - https://bugs.webkit.org/show_bug.cgi?id=69471

Source/WebCore/bindings/v8/ScriptController.h

 /*
  * Copyright (C) 2008, 2009 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 190 matching lines @@
 #if PLATFORM(QT)
     OwnPtr<QScriptEngine> m_qtScriptEngine;
 #endif
 
     // A mapping between Widgets and their corresponding script object.
     // This list is used so that when the plugin dies, we can immediately
     // invalidate all sub-objects which are associated with that plugin.
     // The frame keeps a NPObject reference for each item on the list.
     PluginObjectMap m_pluginObjects;
 #if ENABLE(NETSCAPE_PLUGIN_API)
-    NPObject* m_windowScriptNPObject;
+    // The window script object can get destroyed while there are outstanding
+    // references to it. Please refer to ScriptController::clearScriptObjects
+    // for more information as to why this is necessary. To avoid crashes due
+    // to calls on the destroyed window object, we return a proxy NPObject
+    // which wraps the underlying window object. The wrapped window object
+    // pointer in this object is cleared out when the window object is
+    // destroyed.
+    NPObject* m_wrappedWindowScriptNPObject;
 #endif
 };
 
 } // namespace WebCore
 
 #endif // ScriptController_h