Merge 106722 - [Chromium] WebCore::toV8Context crashes if DomWindow::frame() returns null.

Source/WebCore/bindings/v8/V8Helpers.cpp

 /*
 * Copyright (C) 2008, 2009 Google Inc. All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions are
 * met:
 *
 *     * Redistributions of source code must retain the above copyright
 * notice, this list of conditions and the following disclaimer.
 *     * Redistributions in binary form must reproduce the above
@@ skipping 24 matching lines @@
 #include "Frame.h"
 #include "NPV8Object.h"
 #include "V8Proxy.h"
 
 namespace WebCore {
 
 v8::Local<v8::Context> toV8Context(NPP npp, NPObject* npObject)
 {
     V8NPObject* object = reinterpret_cast<V8NPObject*>(npObject);
     DOMWindow* domWindow = object->rootObject;
-    if (!domWindow || domWindow != domWindow->frame()->domWindow())
+    if (!domWindow || !domWindow->frame() || domWindow != domWindow->frame()->domWindow())
         return v8::Local<v8::Context>();
     return V8Proxy::mainWorldContext(object->rootObject->frame());
 }
 
 V8Proxy* toV8Proxy(NPObject* npObject)
 {
     V8NPObject* object = reinterpret_cast<V8NPObject*>(npObject);
     Frame* frame = object->rootObject->frame();
     return V8Proxy::retrieve(frame);
 }
 
 } // namespace WebCore