Cherry-pick 272448.2@webkit-2023.1-embargoed (20ec584d409c). rdar://1…

…18194384

    HTMLPlugInImageElement: ensure element is connected to the DOM before requesting a load
    https://bugs.webkit.org/show_bug.cgi?id=264626

    Reviewed by Ryosuke Niwa.

    When an object load is requested and this is queued in the event loop,
    the lambda needs to make sure that, by the time it runs, the element
    is still connected to the DOM, as object elements shouldn't be
    loaded if they are not connected, and there is no guarantee
    that in between it doesn't get removed from the tree.

    * Source/WebCore/html/HTMLPlugInImageElement.cpp:
    (WebCore::HTMLPlugInImageElement::requestObject):

    Canonical link: https://commits.webkit.org/272448.2@webkit-2023.1-embargoed

Canonical link: https://commits.webkit.org/272448.562@safari-7618-branch

Source/WebCore/html/HTMLPlugInImageElement.cpp

@@ -330,7 +330,7 @@ bool HTMLPlugInImageElement::requestObject(const String& relativeURL, const Stri
         return document->frame()->loader().subframeLoader().requestObject(*this, relativeURL, getNameAttribute(), mimeType, paramNames, paramValues);
 
     document->eventLoop().queueTask(TaskSource::Networking, [this, protectedThis = Ref { *this }, relativeURL, nameAttribute = getNameAttribute(), mimeType, paramNames, paramValues]() mutable {
-        if (!isConnected())
+        if (!this->isConnected())
             return;
         RefPtr frame = this->document().frame();
         if (!frame)