Fix a crash by search event handler for <input type=search incremental>.

third_party/WebKit/Source/core/html/forms/SearchInputType.cpp

 /*
  * Copyright (C) 2010 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 16 matching lines @@
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 #include "config.h"
 #include "core/html/forms/SearchInputType.h"
 
 #include "bindings/core/v8/ExceptionStatePlaceholder.h"
 #include "core/HTMLNames.h"
 #include "core/InputTypeNames.h"
+#include "core/dom/ExecutionContextTask.h"
 #include "core/dom/shadow/ShadowRoot.h"
 #include "core/events/KeyboardEvent.h"
 #include "core/html/HTMLInputElement.h"
 #include "core/html/shadow/ShadowElementNames.h"
 #include "core/html/shadow/TextControlInnerElements.h"
 #include "core/layout/LayoutSearchField.h"
 #include "wtf/PassOwnPtr.h"
 
 namespace blink {
 
@@ skipping 60 matching lines @@
     TextFieldInputType::handleKeydownEvent(event);
 }
 
 void SearchInputType::startSearchEventTimer()
 {
     ASSERT(element().layoutObject());
     unsigned length = element().innerEditorValue().length();
 
     if (!length) {
         stopSearchEventTimer();
-        element().onSearch();
+        element().document().postTask(BLINK_FROM_HERE, createSameThreadTask(&HTMLInputElement::onSearch, PassRefPtrWillBeRawPtr<HTMLInputElement>(&element())));
         return;
     }
 
     // After typing the first key, we wait 0.5 seconds.
     // After the second key, 0.4 seconds, then 0.3, then 0.2 from then on.
     m_searchEventTimer.startOneShot(max(0.2, 0.6 - 0.1 * length), BLINK_FROM_HERE);
 }
 
 void SearchInputType::stopSearchEventTimer()
 {
@@ skipping 46 matching lines @@
         button->removeInlineStyleProperty(CSSPropertyPointerEvents);
     }
 }
 
 bool SearchInputType::supportsInputModeAttribute() const
 {
     return true;
 }
 
 } // namespace blink