Index: third_party/WebKit/Source/core/html/HTMLInputElement.cpp |
diff --git a/third_party/WebKit/Source/core/html/HTMLInputElement.cpp b/third_party/WebKit/Source/core/html/HTMLInputElement.cpp |
index f06fd168e0d0d868defdd631efbfcad12c09c578..8beafdc24f696395c503d4b3e4660597544362a2 100644 |
--- a/third_party/WebKit/Source/core/html/HTMLInputElement.cpp |
+++ b/third_party/WebKit/Source/core/html/HTMLInputElement.cpp |
@@ -1181,6 +1181,8 @@ void HTMLInputElement::postDispatchEventHandler(Event* event, void* dataFromPreD |
OwnPtrWillBeRawPtr<ClickHandlingState> state = adoptPtrWillBeNoop(static_cast<ClickHandlingState*>(dataFromPreDispatch)); |
if (!state) |
return; |
+ // m_inputTypeView could be freed if the type attribute is modified through a change event handler. |
+ RefPtrWillBeRawPtr<InputTypeView> protect(m_inputTypeView); |
m_inputTypeView->didDispatchClick(event, *state); |
} |