Prevent CheckboxInputType from being freed by change event handlers.

third_party/WebKit/Source/core/html/forms/CheckboxInputType.cpp

 /*
  * Copyright (C) 2010 Google Inc. All rights reserved.
  * Copyright (C) 2011 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
@@ skipping 70 matching lines @@
     if (state->indeterminate)
         element().setIndeterminate(false);
 
     element().setChecked(!state->checked, DispatchChangeEvent);
     m_isInClickHandler = true;
     return state.release();
 }
 
 void CheckboxInputType::didDispatchClick(Event* event, const ClickHandlingState& state)
 {
+    // Prevent change event handlers from indirectly freeing the
+    // CheckboxInputType via a modification of the "type" attribute on the
+    // HTMLInputElement.
+    RefPtrWillBeRawPtr<CheckboxInputType> protect(this);
+
     if (event->defaultPrevented() || event->defaultHandled()) {
         element().setIndeterminate(state.indeterminate);
         element().setChecked(state.checked);
     } else {
         element().dispatchChangeEventIfNeeded();
     }
     m_isInClickHandler = false;
     // The work we did in willDispatchClick was default handling.
     event->setDefaultHandled();
 }
 
 bool CheckboxInputType::shouldAppearIndeterminate() const
 {
     return element().indeterminate();
 }
 
 } // namespace blink