Merge r245284 - Protect current WebFrame during form submission

https://bugs.webkit.org/show_bug.cgi?id=197459
<rdar://problem/50368618>

Reviewed by Alex Christensen.

The 'continueWillSubmitForm' method calls a completion handler that
might affect the state of the current frame. Ensure the frame is valid
for the scope of the function.

* WebProcess/WebPage/WebFrame.cpp:
(WebKit::WebFrame::continueWillSubmitForm):

Source/WebKit/ChangeLog

@@ -1,3 +1,18 @@
+2019-05-14  Brent Fulgham  <bfulgham@apple.com>
+
+        Protect current WebFrame during form submission
+        https://bugs.webkit.org/show_bug.cgi?id=197459
+        <rdar://problem/50368618>
+
+        Reviewed by Alex Christensen.
+
+        The 'continueWillSubmitForm' method calls a completion handler that
+        might affect the state of the current frame. Ensure the frame is valid
+        for the scope of the function.
+
+        * WebProcess/WebPage/WebFrame.cpp:
+        (WebKit::WebFrame::continueWillSubmitForm):
+
 2019-05-10  Brent Fulgham  <bfulgham@apple.com>
 
         Streamline test-and-clear operation for ContextMenu

Source/WebKit/WebProcess/WebPage/WebFrame.cpp

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2010-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2010-2019 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -233,6 +233,7 @@ uint64_t WebFrame::setUpWillSubmitFormListener(CompletionHandler<void()>&& compl
 
 void WebFrame::continueWillSubmitForm(uint64_t listenerID)
 {
+    Ref<WebFrame> protectedThis(*this);
     if (auto completionHandler = m_willSubmitFormCompletionHandlers.take(listenerID))
         completionHandler();
     invalidatePolicyListener();