Element::focus() should acquire the reference of LocalFrame.

Element::focus() should acquire the reference of LocalFrame.

FrameSelection::setSelection() may cause some DOM events to happen synchro-
nously, which could free the frame and produce a dangling pointer to the frame.

This patch extends the lifetime of the frame object and fixes this use-after-
free.

BUG=357669
Committed: https://src.chromium.org/viewvc/blink?view=rev&revision=171415

[Yuta Kitamura, 2014-04-11 09:25:08]

Debug for a whole day and come up with one-line change...

[yosin_UTC9, 2014-04-14 02:00:27]

LGTM

https://codereview.chromium.org/225163004/diff/1/LayoutTests/editing/selectio...
File LayoutTests/editing/selection/focus-iframe-removal-crash.html (right):

https://codereview.chromium.org/225163004/diff/1/LayoutTests/editing/selectio...
LayoutTests/editing/selection/focus-iframe-removal-crash.html:17:
iframe.contentDocument.documentElement.addEventListener('DOMFocusOut', function
() {
nit: Can we use "focusout" instead of "DOMFocusOut"?
"DOMFocusOut" is deprecated by DOM L3 Event,
http://www.w3.org/TR/DOM-Level-3-Events/#legacy-event-types

[Yuta Kitamura, 2014-04-14 02:43:52]

The CQ bit was checked by yutak@chromium.org

[commit-bot: I haz the power, 2014-04-14 02:44:04]

CQ is trying da patch. Follow status at
https://chromium-status.appspot.com/cq/yutak@chromium.org/225163004/20001

[Yuta Kitamura, 2014-04-14 02:44:32]

https://codereview.chromium.org/225163004/diff/1/LayoutTests/editing/selectio...
File LayoutTests/editing/selection/focus-iframe-removal-crash.html (right):

https://codereview.chromium.org/225163004/diff/1/LayoutTests/editing/selectio...
LayoutTests/editing/selection/focus-iframe-removal-crash.html:17:
iframe.contentDocument.documentElement.addEventListener('DOMFocusOut', function
() {
On 2014/04/14 02:00:27, Yoshi wrote:
> nit: Can we use "focusout" instead of "DOMFocusOut"?
> "DOMFocusOut" is deprecated by DOM L3 Event,
> http://www.w3.org/TR/DOM-Level-3-Events/#legacy-event-types

Done.

[commit-bot: I haz the power, 2014-04-14 03:43:03]

Change committed as 171415