Properly fix use-after-free of InputTypeViews when the type attribute is modified in the change eve…

third_party/WebKit/Source/core/html/HTMLInputElement.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
  * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009, 2010, 2011 Apple Inc. All rights reserved.
  *           (C) 2006 Alexey Proskuryakov (ap@nypop.com)
  * Copyright (C) 2007 Samuel Weinig (sam@webkit.org)
  * Copyright (C) 2010 Google Inc. All rights reserved.
  * Copyright (C) 2008 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  * Copyright (C) 2012 Samsung Electronics. All rights reserved.
@@ skipping 1163 matching lines @@
     // FIXME: Check whether there are any cases where this actually ends up leaking.
     return m_inputTypeView->willDispatchClick().leakPtr();
 #endif
 }
 
 void HTMLInputElement::postDispatchEventHandler(Event* event, void* dataFromPreDispatch)
 {
     OwnPtrWillBeRawPtr<ClickHandlingState> state = adoptPtrWillBeNoop(static_cast<ClickHandlingState*>(dataFromPreDispatch));
     if (!state)
         return;
+    // m_inputTypeView could be freed if the type attribute is modified through a change event handler.
+    RefPtrWillBeRawPtr<InputTypeView> protect(m_inputTypeView);
     m_inputTypeView->didDispatchClick(event, *state);
 }
 
 void HTMLInputElement::defaultEventHandler(Event* evt)
 {
     if (evt->isMouseEvent() && evt->type() == EventTypeNames::click && toMouseEvent(evt)->button() == LeftButton) {
         m_inputTypeView->handleClickEvent(toMouseEvent(evt));
         if (evt->defaultHandled())
             return;
     }
@@ skipping 745 matching lines @@
 void HTMLInputElement::ensurePrimaryContent()
 {
     m_inputTypeView->ensurePrimaryContent();
 }
 
 bool HTMLInputElement::hasFallbackContent() const
 {
     return m_inputTypeView->hasFallbackContent();
 }
 } // namespace