Fix use-afer-free in PrintContext.

third_party/WebKit/Source/core/page/PrintContext.cpp

 /*
  * Copyright (C) 2007 Alp Toker <alp@atoker.com>
  * Copyright (C) 2007 Apple Inc.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
  * version 2 of the License, or (at your option) any later version.
  *
  * This library is distributed in the hope that it will be useful,
@@ skipping 172 matching lines @@
         object = object->parent();
     if (!object)
         return nullptr;
     return toLayoutBoxModelObject(object);
 }
 
 int PrintContext::pageNumberForElement(Element* element, const FloatSize& pageSizeInPixels)
 {
     element->document().updateLayout();
 
+    LocalFrame* frame = element->document().frame();
+    FloatRect pageRect(FloatPoint(0, 0), pageSizeInPixels);
+    PrintContext printContext(frame);
+    printContext.begin(pageRect.width(), pageRect.height());
+
     LayoutBoxModelObject* box = enclosingBoxModelObject(element->layoutObject());
     if (!box)
         return -1;
 
-    LocalFrame* frame = element->document().frame();
-    FloatRect pageRect(FloatPoint(0, 0), pageSizeInPixels);
-    PrintContext printContext(frame);
-    printContext.begin(pageRect.width(), pageRect.height());
     FloatSize scaledPageSize = pageSizeInPixels;
     scaledPageSize.scale(frame->view()->contentsSize().width() / pageRect.width());
     printContext.computePageRectsWithPageSize(scaledPageSize);
 
     int top = box->pixelSnappedOffsetTop();
     int left = box->pixelSnappedOffsetLeft();
     size_t pageNumber = 0;
     for (; pageNumber < printContext.pageCount(); pageNumber++) {
         const IntRect& page = printContext.pageRect(pageNumber);
         if (page.x() <= left && left < page.maxX() && page.y() <= top && top < page.maxY())
@@ skipping 103 matching lines @@
     return printContext.pageCount();
 }
 
 DEFINE_TRACE(PrintContext)
 {
     visitor->trace(m_frame);
     visitor->trace(m_linkedDestinations);
 }
 
 } // namespace blink