Merge 127117

Source/WebCore/bindings/v8/V8AbstractEventListener.h

 /*
  * Copyright (C) 2006, 2007, 2008, 2009 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 61 matching lines @@
 
         virtual bool operator==(const EventListener& other) { return this == &other; }
 
         virtual void handleEvent(ScriptExecutionContext*, Event*);
 
         virtual bool isLazy() const { return false; }
 
         // Returns the listener object, either a function or an object.
         v8::Local<v8::Object> getListenerObject(ScriptExecutionContext* context)
         {
+            // prepareListenerObject can potentially deref this event listener
+            // as it may attempt to compile a function (lazy event listener), get an error
+            // and invoke onerror callback which can execute arbitrary JS code.
+            // Protect this event listener to keep it alive.
+            RefPtr<V8AbstractEventListener> guard(this);
             prepareListenerObject(context);
             return v8::Local<v8::Object>::New(m_listener);
         }
 
         v8::Local<v8::Object> getExistingListenerObject()
         {
             return v8::Local<v8::Object>::New(m_listener);
         }
 
         // Provides access to the underlying handle for GC. Returned
@@ skipping 37 matching lines @@
 
         // Indicates if this is an HTML type listener.
         bool m_isAttribute;
 
         WorldContextHandle m_worldContext;
     };
 
 } // namespace WebCore
 
 #endif // V8AbstractEventListener_h