Merge 127117

Source/WebCore/bindings/v8/V8AbstractEventListener.h

Index: Source/WebCore/bindings/v8/V8AbstractEventListener.h
===================================================================
--- Source/WebCore/bindings/v8/V8AbstractEventListener.h	(revision 127629)
+++ Source/WebCore/bindings/v8/V8AbstractEventListener.h	(working copy)
@@ -79,6 +79,11 @@
         // Returns the listener object, either a function or an object.
         v8::Local<v8::Object> getListenerObject(ScriptExecutionContext* context)
         {
+            // prepareListenerObject can potentially deref this event listener
+            // as it may attempt to compile a function (lazy event listener), get an error
+            // and invoke onerror callback which can execute arbitrary JS code.
+            // Protect this event listener to keep it alive.
+            RefPtr<V8AbstractEventListener> guard(this);
             prepareListenerObject(context);
             return v8::Local<v8::Object>::New(m_listener);
         }