Properly fix use-after-free of InputTypeViews when the type attribute is modified in the change eve…

third_party/WebKit/Source/core/html/forms/CheckboxInputType.cpp

Index: third_party/WebKit/Source/core/html/forms/CheckboxInputType.cpp
diff --git a/third_party/WebKit/Source/core/html/forms/CheckboxInputType.cpp b/third_party/WebKit/Source/core/html/forms/CheckboxInputType.cpp
index 5e5ce039976bbd2b026853713c107e6431c1e932..2be0d9608d086caf5c0fbfb318c8b87ee08f9411 100644
--- a/third_party/WebKit/Source/core/html/forms/CheckboxInputType.cpp
+++ b/third_party/WebKit/Source/core/html/forms/CheckboxInputType.cpp
@@ -88,11 +88,6 @@ PassOwnPtrWillBeRawPtr<ClickHandlingState> CheckboxInputType::willDispatchClick(
 
 void CheckboxInputType::didDispatchClick(Event* event, const ClickHandlingState& state)
 {
-    // Prevent change event handlers from indirectly freeing the
-    // CheckboxInputType via a modification of the "type" attribute on the
-    // HTMLInputElement.
-    RefPtrWillBeRawPtr<CheckboxInputType> protect(this);
-
     if (event->defaultPrevented() || event->defaultHandled()) {
         element().setIndeterminate(state.indeterminate);
         element().setChecked(state.checked);