Merge 99311 - [V8] Null out V8NPObject::rootObject when the owning

Source/WebCore/bindings/v8/V8Helpers.cpp

 /*
 * Copyright (C) 2008, 2009 Google Inc. All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions are
 * met:
 *
 *     * Redistributions of source code must retain the above copyright
 * notice, this list of conditions and the following disclaimer.
 *     * Redistributions in binary form must reproduce the above
@@ skipping 14 matching lines @@
 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 */
 
 #include "config.h"
 #include "V8Helpers.h"
 
 #include "DOMWindow.h"
+#include "Frame.h"
 #include "NPV8Object.h"
 #include "V8Proxy.h"
 
 namespace WebCore {
 
 v8::Local<v8::Context> toV8Context(NPP npp, NPObject* npObject)
 {
     V8NPObject* object = reinterpret_cast<V8NPObject*>(npObject);
+    DOMWindow* domWindow = object->rootObject;
+    if (!domWindow || domWindow != domWindow->frame()->domWindow())
+        return v8::Local<v8::Context>();
     return V8Proxy::mainWorldContext(object->rootObject->frame());
 }
 
 V8Proxy* toV8Proxy(NPObject* npObject)
 {
     V8NPObject* object = reinterpret_cast<V8NPObject*>(npObject);
     Frame* frame = object->rootObject->frame();
     return V8Proxy::retrieve(frame);
 }
 
 } // namespace WebCore