Merge 99311 - [V8] Null out V8NPObject::rootObject when the owning

Source/WebCore/bindings/v8/npruntime.cpp

 /*
  * Copyright (C) 2004, 2006 Apple Computer, Inc.  All rights reserved.
  * Copyright (C) 2007-2009 Google, Inc.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
@@ skipping 400 matching lines @@
             int size = set->size();
 #endif
             NPObject* sub_object = *(set->begin());
             // The sub-object should not be a owner!
             ASSERT(rootObjectMap.find(sub_object) == rootObjectMap.end());
 
             // First, unregister the object.
             set->remove(sub_object);
             liveObjectMap.remove(sub_object);
 
+            // Script objects hold a refernce to their DOMWindow*, which is going away if
+            // we're unregistering the associated owner NPObject. Clear it out.
+            if (sub_object->_class == npScriptObjectClass) {
+                V8NPObject* v8npObject = reinterpret_cast<V8NPObject*>(sub_object);
+                v8npObject->rootObject = 0;
+            }
+
             // Remove the JS references to the object.
             forgetV8ObjectForNPObject(sub_object);
 
             ASSERT(set->size() < size);
         }
         delete set;
         rootObjectMap.remove(npObject);
     } else {
         NPRootObjectMap::iterator ownerEntry = rootObjectMap.find(owner);
         if (ownerEntry != rootObjectMap.end()) {
             NPObjectSet* list = ownerEntry->second;
             ASSERT(list->find(npObject) != list->end());
             list->remove(npObject);
         }
     }
 
     liveObjectMap.remove(npObject);
     forgetV8ObjectForNPObject(npObject);
 }
 
 bool _NPN_IsAlive(NPObject* npObject)
 {
     return liveObjectMap.find(npObject) != liveObjectMap.end();
 }
 
 }  // extern "C"