Heap-use-after-free in WebCore::Document::implicitClose
https://bugs.webkit.org/show_bug.cgi?id=105655

Reviewed by Eric Seidel.

Source/WebCore:

Test: fast/dom/window-load-crash.html

* dom/Document.cpp:
(WebCore::Document::implicitClose): RefPtr protect |this| document since it
can be destroyed in the dispatchWindowLoadEvent call.

LayoutTests:

* fast/dom/window-load-crash-expected.txt: Added.
* fast/dom/window-load-crash.html: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@138918 268f45cc-cd09-0410-ab3c-d52691b4dbfc