UpdateWidget() can fire beforeload event synchronously blowing away RenderArena and its associated …

Source/core/page/FrameView.h

 /*
    Copyright (C) 1997 Martin Jones (mjones@kde.org)
              (C) 1998 Waldo Bastian (bastian@kde.org)
              (C) 1998, 1999 Torben Weis (weis@kde.org)
              (C) 1999 Lars Knoll (knoll@kde.org)
              (C) 1999 Antti Koivisto (koivisto@kde.org)
    Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
 
    This library is free software; you can redistribute it and/or
    modify it under the terms of the GNU Library General Public
@@ skipping 400 matching lines @@
 
     virtual void notifyPageThatContentAreaWillPaint() const;
 
     bool shouldUseLoadTimeDeferredRepaintDelay() const;
     void deferredRepaintTimerFired(Timer<FrameView>*);
     void doDeferredRepaints();
     void updateDeferredRepaintDelayAfterRepaint();
     double adjustedDeferredRepaintDelay() const;
 
     bool updateWidgets();
-    void updateWidget(RenderObject*);
+    bool updateWidget(RenderObject*);
     void scrollToAnchor();
     void scrollPositionChanged();
 
     bool hasCustomScrollbars() const;
 
     virtual void updateScrollCorner();
 
     FrameView* parentFrameView() const;
 
     bool doLayoutWithFrameFlattening(bool allowSubtree);
@@ skipping 159 matching lines @@
     ASSERT(!widget || widget->isFrameView());
     return static_cast<const FrameView*>(widget);
 }
 
 // This will catch anyone doing an unnecessary cast.
 void toFrameView(const FrameView*);
 
 } // namespace WebCore
 
 #endif // FrameView_h