Merge 99311 - [V8] Null out V8NPObject::rootObject when the owning

Source/WebCore/bindings/v8/npruntime.cpp

Index: Source/WebCore/bindings/v8/npruntime.cpp
===================================================================
--- Source/WebCore/bindings/v8/npruntime.cpp	(revision 99451)
+++ Source/WebCore/bindings/v8/npruntime.cpp	(working copy)
@@ -418,6 +418,13 @@
             set->remove(sub_object);
             liveObjectMap.remove(sub_object);
 
+            // Script objects hold a refernce to their DOMWindow*, which is going away if
+            // we're unregistering the associated owner NPObject. Clear it out.
+            if (sub_object->_class == npScriptObjectClass) {
+                V8NPObject* v8npObject = reinterpret_cast<V8NPObject*>(sub_object);
+                v8npObject->rootObject = 0;
+            }
+
             // Remove the JS references to the object.
             forgetV8ObjectForNPObject(sub_object);