Prevent CheckboxInputType from being freed by change event handlers.

third_party/WebKit/Source/core/html/forms/CheckboxInputType.cpp

Index: third_party/WebKit/Source/core/html/forms/CheckboxInputType.cpp
diff --git a/third_party/WebKit/Source/core/html/forms/CheckboxInputType.cpp b/third_party/WebKit/Source/core/html/forms/CheckboxInputType.cpp
index 2be0d9608d086caf5c0fbfb318c8b87ee08f9411..5e5ce039976bbd2b026853713c107e6431c1e932 100644
--- a/third_party/WebKit/Source/core/html/forms/CheckboxInputType.cpp
+++ b/third_party/WebKit/Source/core/html/forms/CheckboxInputType.cpp
@@ -88,6 +88,11 @@ PassOwnPtrWillBeRawPtr<ClickHandlingState> CheckboxInputType::willDispatchClick(
 
 void CheckboxInputType::didDispatchClick(Event* event, const ClickHandlingState& state)
 {
+    // Prevent change event handlers from indirectly freeing the
+    // CheckboxInputType via a modification of the "type" attribute on the
+    // HTMLInputElement.
+    RefPtrWillBeRawPtr<CheckboxInputType> protect(this);
+
     if (event->defaultPrevented() || event->defaultHandled()) {
         element().setIndeterminate(state.indeterminate);
         element().setChecked(state.checked);