Abort forwarding remote input events when layoutObject is gone.

Source/web/RemoteFrameClientImpl.cpp

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "config.h"
 #include "web/RemoteFrameClientImpl.h"
 
 #include "core/events/KeyboardEvent.h"
 #include "core/events/MouseEvent.h"
 #include "core/events/WheelEvent.h"
@@ skipping 105 matching lines @@
     // session history length. For now, return static value for the initial
     // navigation and the subsequent one moving the frame out-of-process.
     // See https://crbug.com/501116.
     return 2;
 }
 
 // FIXME: Remove this code once we have input routing in the browser
 // process. See http://crbug.com/339659.
 void RemoteFrameClientImpl::forwardInputEvent(Event* event)
 {
+    // It is possible for an event to cause the remote iframe element to be
+    // hidden, which destroys the layout object. In that case we do not
+    // forward. See https://crbug.com/520705.

[dcheng, 2015/08/18 17:44:19]

I don't think I followed the explanation in the bug. Would you be able to
explain this in more detail? VC or expanding the comment would be helpful, since
we don't have a layout test.

[kenrb, 2015/08/19 15:53:51]

Comment expanded.

+    if (!toCoreFrame(m_webFrame)->ownerLayoutObject())
+        return;
+
     // This is only called when we have out-of-process iframes, which
     // need to forward input events across processes.
     // FIXME: Add a check for out-of-process iframes enabled.
     OwnPtr<WebInputEvent> webEvent;
     if (event->isKeyboardEvent())
         webEvent = adoptPtr(new WebKeyboardEventBuilder(*static_cast<KeyboardEvent*>(event)));
     else if (event->isMouseEvent())
         webEvent = adoptPtr(new WebMouseEventBuilder(m_webFrame->frame()->view(), toCoreFrame(m_webFrame)->ownerLayoutObject(), *static_cast<MouseEvent*>(event)));
     else if (event->isWheelEvent())
         webEvent = adoptPtr(new WebMouseWheelEventBuilder(m_webFrame->frame()->view(), toCoreFrame(m_webFrame)->ownerLayoutObject(), *static_cast<WheelEvent*>(event)));
 
     // Other or internal Blink events should not be forwarded.
     if (!webEvent || webEvent->type == WebInputEvent::Undefined)
         return;
 
     m_webFrame->client()->forwardInputEvent(webEvent.get());
 }
 
 } // namespace blink