UpdateWidget() can fire beforeload event synchronously blowing away RenderArena and its associated …

Source/core/page/FrameView.cpp

 /*
  * Copyright (C) 1998, 1999 Torben Weis <weis@kde.org>
  *                     1999 Lars Knoll <knoll@kde.org>
  *                     1999 Antti Koivisto <koivisto@kde.org>
  *                     2000 Dirk Mueller <mueller@kde.org>
  * Copyright (C) 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
  *           (C) 2006 Graham Dennis (graham.dennis@gmail.com)
  *           (C) 2006 Alexey Proskuryakov (ap@nypop.com)
  * Copyright (C) 2009 Google Inc. All rights reserved.
  *
@@ skipping 2243 matching lines @@
     if (AXObjectCache* cache = m_frame->document()->existingAXObjectCache())
         cache->handleScrolledToAnchor(anchorNode.get());
 
     // scrollRectToVisible can call into setScrollPosition(), which resets m_maintainScrollPositionAnchor.
     m_maintainScrollPositionAnchor = anchorNode;
 }
 
 void FrameView::updateWidget(RenderObject* object)
 {
     ASSERT(!object->node() || object->node()->isElementNode());
-    Element* ownerElement = toElement(object->node());
+    RefPtr<Element> ownerElement = toElement(object->node());

[eseidel, 2013/04/18 02:14:23]

I don't believe that holding onto the Element will cause the Document to stay
alive (the Document holds the RenderArena).

     // The object may have already been destroyed (thus node cleared),
     // but FrameView holds a manual ref, so it won't have been deleted.
     ASSERT(m_widgetUpdateSet->contains(object));
     if (!ownerElement)
         return;
 
     if (object->isEmbeddedObject()) {
         RenderEmbeddedObject* embeddedObject = static_cast<RenderEmbeddedObject*>(object);
         // No need to update if it's already crashed or known to be missing.
         if (embeddedObject->showsUnavailablePluginIndicator())
             return;
 
         // FIXME: This could turn into a real virtual dispatch if we defined
         // updateWidget(PluginCreationOption) on HTMLElement.
         if (ownerElement->hasTagName(objectTag) || ownerElement->hasTagName(embedTag) || ownerElement->hasTagName(appletTag)) {
-            HTMLPlugInImageElement* pluginElement = toHTMLPlugInImageElement(ownerElement);
+            HTMLPlugInImageElement* pluginElement = toHTMLPlugInImageElement(ownerElement.get());
             if (pluginElement->needsWidgetUpdate())
                 pluginElement->updateWidget(CreateAnyWidgetType);
         } else
             ASSERT_NOT_REACHED();
 
         // Caution: it's possible the object was destroyed again, since loading a
         // plugin may run any arbitrary JavaScript.
+        RELEASE_ASSERT(ownerElement->renderer() == embeddedObject);

[eseidel, 2013/04/18 00:13:00]

Why is crashing the right thing to do here?  What does just returning do?

If we returned then we could test this. :)

[eseidel, 2013/04/18 02:14:23]

I wouldn't ASSERT, I would just return here.  We don't need to crash in this
case.  Not notifying the widget of it's correct position is at worst a display
bug, and in this case, the widget is gone, so we just want to stop trying to
talk to it!

         embeddedObject->updateWidgetPosition();
     }
 }
 
 bool FrameView::updateWidgets()
 {
     if (m_nestedLayoutCount > 1 || !m_widgetUpdateSet || m_widgetUpdateSet->isEmpty())
         return true;
     
     size_t size = m_widgetUpdateSet->size();
@@ skipping 1295 matching lines @@
 }
     
 AXObjectCache* FrameView::axObjectCache() const
 {
     if (frame() && frame()->document())
         return frame()->document()->existingAXObjectCache();
     return 0;
 }
     
 } // namespace WebCore