Merge 97087 - ScriptController::executeIfJavaScriptURL gets confused by synchronous frame loads

Source/WebCore/bindings/ScriptControllerBase.cpp

Index: Source/WebCore/bindings/ScriptControllerBase.cpp
===================================================================
--- Source/WebCore/bindings/ScriptControllerBase.cpp	(revision 97088)
+++ Source/WebCore/bindings/ScriptControllerBase.cpp	(working copy)
@@ -93,6 +93,7 @@
     // We need to hold onto the Frame here because executing script can
     // destroy the frame.
     RefPtr<Frame> protector(m_frame);
+    RefPtr<Document> ownerDocument(m_frame->document());
 
     const int javascriptSchemeLength = sizeof("javascript:") - 1;
 
@@ -125,7 +126,7 @@
         // DocumentWriter::replaceDocument can cause the DocumentLoader to get deref'ed and possible destroyed,
         // so protect it with a RefPtr.
         if (RefPtr<DocumentLoader> loader = m_frame->document()->loader())
-            loader->writer()->replaceDocument(scriptResult);
+            loader->writer()->replaceDocument(scriptResult, ownerDocument.get());
     }
     return true;
 }