Harden the machinery around updateWidgetPositions()

Source/core/rendering/RenderLayerScrollableArea.cpp

 /*
  * Copyright (C) 2006, 2007, 2008, 2009, 2010, 2011, 2012 Apple Inc. All rights reserved.
  *
  * Portions are Copyright (C) 1998 Netscape Communications Corporation.
  *
  * Other contributors:
  *   Robert O'Callahan <roc+@cs.cmu.edu>
  *   David Baron <dbaron@fas.harvard.edu>
  *   Christian Biesinger <cbiesinger@web.de>
  *   Randall Jesup <rjesup@wgate.com>
@@ skipping 312 matching lines @@
         if (m_scrollDimensionsDirty)
             computeScrollDimensions();
     }
 
     if (scrollOffset() == toIntSize(newScrollOffset))
         return;
 
     setScrollOffset(toIntSize(newScrollOffset));
 
     Frame* frame = m_box->frame();
+    ASSERT(frame);
+
+    RefPtr<FrameView> frameView = m_box->frameView();
+
     InspectorInstrumentation::willScrollLayer(m_box);
 
-    RenderView* view = m_box->view();
-
-    // We should have a RenderView if we're trying to scroll.
-    ASSERT(view);
-
     // Update the positions of our child layers (if needed as only fixed layers should be impacted by a scroll).
     // We don't update compositing layers, because we need to do a deep update from the compositing ancestor.
-    bool inLayout = view ? view->frameView()->isInLayout() : false;
-    if (!inLayout) {
+    if (!frameView->isInLayout()) {
         // If we're in the middle of layout, we'll just update layers once layout has finished.
         layer()->updateLayerPositionsAfterOverflowScroll();
-        if (view) {
-            // Update regions, scrolling may change the clip of a particular region.
-            view->frameView()->updateAnnotatedRegions();
-            view->updateWidgetPositions();
-        }
-
+        // Update regions, scrolling may change the clip of a particular region.
+        frameView->updateAnnotatedRegions();
+        // FIXME: We shouldn't call updateWidgetPositions() here since it might tear down the render tree,
+        // for now we just crash to avoid allowing an attacker to use after free.
+        frameView->updateWidgetPositions();
+        RELEASE_ASSERT(frameView->renderView());
         updateCompositingLayersAfterScroll();
     }
 
     RenderLayerModelObject* repaintContainer = m_box->containerForRepaint();
-    if (frame) {
-        // The caret rect needs to be invalidated after scrolling
-        frame->selection().setCaretRectNeedsUpdate();
+    // The caret rect needs to be invalidated after scrolling
+    frame->selection().setCaretRectNeedsUpdate();
 
-        FloatQuad quadForFakeMouseMoveEvent = FloatQuad(layer()->repainter().repaintRect());
-        if (repaintContainer)
-            quadForFakeMouseMoveEvent = repaintContainer->localToAbsoluteQuad(quadForFakeMouseMoveEvent);
-        frame->eventHandler().dispatchFakeMouseMoveEventSoonInQuad(quadForFakeMouseMoveEvent);
-    }
+    FloatQuad quadForFakeMouseMoveEvent = FloatQuad(layer()->repainter().repaintRect());
+    if (repaintContainer)
+        quadForFakeMouseMoveEvent = repaintContainer->localToAbsoluteQuad(quadForFakeMouseMoveEvent);
+    frame->eventHandler().dispatchFakeMouseMoveEventSoonInQuad(quadForFakeMouseMoveEvent);
 
     bool requiresRepaint = true;
 
     if (m_box->view()->compositor()->inCompositingMode()) {
         bool onlyScrolledCompositedLayers = scrollsOverflow()
             && !layer()->hasVisibleNonLayerContent()
             && !layer()->hasNonCompositedChild()
             && !layer()->hasBlockSelectionGapBounds()
             && !m_box->isMarquee();
 
         if (usesCompositedScrolling() || onlyScrolledCompositedLayers)
             requiresRepaint = false;
     }
 
     // Just schedule a full repaint of our object.
-    if (view && requiresRepaint)
+    if (requiresRepaint)
         m_box->repaintUsingContainer(repaintContainer, pixelSnappedIntRect(layer()->repainter().repaintRect()));
 
     // Schedule the scroll DOM event.
     if (m_box->node())
         m_box->node()->document().enqueueScrollEventForNode(m_box->node());
 
     InspectorInstrumentation::didScrollLayer(m_box);
 }
 
 IntPoint RenderLayerScrollableArea::scrollPosition() const
@@ skipping 1075 matching lines @@
 void RenderLayerScrollableArea::setForceNeedsCompositedScrolling(ForceNeedsCompositedScrollingMode mode)
 {
     if (m_forceNeedsCompositedScrolling == mode)
         return;
 
     m_forceNeedsCompositedScrolling = mode;
     layer()->didUpdateNeedsCompositedScrolling();
 }
 
 } // Namespace WebCore