Merge 97087 - ScriptController::executeIfJavaScriptURL gets confused by synchronous frame loads

Source/WebKit/chromium/src/WebFrameImpl.cpp

 /*
  * Copyright (C) 2009 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 2241 matching lines @@
     // Unfortunately, we cannot just use that method since it is private, and
     // it also doesn't quite behave as we require it to for bookmarklets.  The
     // key difference is that we need to suppress loading the string result
     // from evaluating the JS URL if executing the JS URL resulted in a
     // location change.  We also allow a JS URL to be loaded even if scripts on
     // the page are otherwise disabled.
 
     if (!m_frame->document() || !m_frame->page())
         return;
 
+    RefPtr<Document> ownerDocument(m_frame->document());
+
     // Protect privileged pages against bookmarklets and other javascript manipulations.
     if (SchemeRegistry::shouldTreatURLSchemeAsNotAllowingJavascriptURLs(m_frame->document()->url().protocol()))
         return;
 
     String script = decodeURLEscapeSequences(url.string().substring(strlen("javascript:")));
     ScriptValue result = m_frame->script()->executeScript(script, true);
 
     String scriptResult;
     if (!result.getString(scriptResult))
         return;
 
     if (!m_frame->navigationScheduler()->locationChangePending())
-        m_frame->document()->loader()->writer()->replaceDocument(scriptResult);
+        m_frame->document()->loader()->writer()->replaceDocument(scriptResult, ownerDocument.get());
 }
 
 } // namespace WebKit