Abort forwarding remote input events when layoutObject is gone.

Source/web/RemoteFrameClientImpl.cpp

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "config.h"
 #include "web/RemoteFrameClientImpl.h"
 
 #include "core/events/KeyboardEvent.h"
 #include "core/events/MouseEvent.h"
 #include "core/events/WheelEvent.h"
@@ skipping 105 matching lines @@
     // session history length. For now, return static value for the initial
     // navigation and the subsequent one moving the frame out-of-process.
     // See https://crbug.com/501116.
     return 2;
 }
 
 // FIXME: Remove this code once we have input routing in the browser
 // process. See http://crbug.com/339659.
 void RemoteFrameClientImpl::forwardInputEvent(Event* event)
 {
+    // It is possible for an event to cause the remote iframe element to be

[dcheng, 2015/08/19 16:28:10]

an event => a platform event

[kenrb, 2015/08/19 20:34:11]

Done.

+    // hidden, which destroys the layout object (for instance, a MouseOver

[dcheng, 2015/08/19 16:28:10]

for instance, a mouse event that moves between elements will trigger a mouseout
on the old element, which might hide the new element

[kenrb, 2015/08/19 20:34:11]

Done.

+    // event on the iframe can trigger a MouseOut handler on another element
+    // that hides the iframe). In that case we do not forward.
+    // This is divergent behavior from local frames, where the content of the
+    // frame can receive events even after the frame is hidden. We might
+    // need to revisit this after browser hit testing is fully implemented,
+    // since this code path will need to be removed or refactored anyway.
+    // See https://crbug.com/520705.
+    if (!toCoreFrame(m_webFrame)->ownerLayoutObject())
+        return;
+
     // This is only called when we have out-of-process iframes, which
     // need to forward input events across processes.
     // FIXME: Add a check for out-of-process iframes enabled.
     OwnPtr<WebInputEvent> webEvent;
     if (event->isKeyboardEvent())
         webEvent = adoptPtr(new WebKeyboardEventBuilder(*static_cast<KeyboardEvent*>(event)));
     else if (event->isMouseEvent())
         webEvent = adoptPtr(new WebMouseEventBuilder(m_webFrame->frame()->view(), toCoreFrame(m_webFrame)->ownerLayoutObject(), *static_cast<MouseEvent*>(event)));
     else if (event->isWheelEvent())
         webEvent = adoptPtr(new WebMouseWheelEventBuilder(m_webFrame->frame()->view(), toCoreFrame(m_webFrame)->ownerLayoutObject(), *static_cast<WheelEvent*>(event)));
 
     // Other or internal Blink events should not be forwarded.
     if (!webEvent || webEvent->type == WebInputEvent::Undefined)
         return;
 
     m_webFrame->client()->forwardInputEvent(webEvent.get());
 }
 
 } // namespace blink