Check frame for nullptr in AutoscrollController::animate

third_party/WebKit/Source/core/page/AutoscrollController.cpp

 /*
  * Copyright (C) 2013 Google Inc. All rights reserved.
  * Copyright (C) 2006, 2007, 2008, 2009, 2010, 2011 Apple Inc. All rights reserved.
  * Copyright (C) 2006 Alexey Proskuryakov (ap@webkit.org)
  * Copyright (C) 2012 Digia Plc. and/or its subsidiary(-ies)
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
@@ skipping 223 matching lines @@
 
 // FIXME: This would get get better animation fidelity if it used the monotonicFrameBeginTime instead
 // of WTF::currentTime().
 void AutoscrollController::animate(double)
 {
     if (!m_autoscrollLayoutObject) {
         stopAutoscroll();
         return;
     }
 
-    EventHandler& eventHandler = m_autoscrollLayoutObject->frame()->eventHandler();

[dtapuska, 2016/09/08 14:13:20]

I was kind of anticipating a change like

LocalFrame* frame = m_autoscrollLayoutObject->frame();
if (!frame) {
  stopAutoscroll();
  return;
}
...

I think this can still cause a crash on line: 
https://cs.chromium.org/chromium/src/third_party/WebKit/Source/core/page/Auto...

whereas the way I was thinking it wouldn't. Sorry for my delay on the review.

     switch (m_autoscrollType) {
     case AutoscrollForDragAndDrop:
         if (WTF::currentTime() - m_dragAndDropAutoscrollStartTime > autoscrollDelay)
             m_autoscrollLayoutObject->autoscroll(m_dragAndDropAutoscrollReferencePosition);
         break;
     case AutoscrollForSelection:
-        if (!eventHandler.mousePressed()) {
-            stopAutoscroll();
-            return;
+        if (LocalFrame* frame = m_autoscrollLayoutObject->frame()) {
+            EventHandler& eventHandler = frame->eventHandler();
+            if (!eventHandler.mousePressed()) {
+                stopAutoscroll();
+                return;
+            }
+            eventHandler.updateSelectionForMouseDrag();
+            m_autoscrollLayoutObject->autoscroll(eventHandler.lastKnownMousePosition());
         }
-        eventHandler.updateSelectionForMouseDrag();
-        m_autoscrollLayoutObject->autoscroll(eventHandler.lastKnownMousePosition());
         break;
     case NoAutoscroll:
         break;
 #if OS(WIN)
     case AutoscrollForPanCanStop:
     case AutoscrollForPan:
         if (!panScrollInProgress()) {
             stopAutoscroll();
             return;
         }
-        if (FrameView* view = m_autoscrollLayoutObject->frame()->view())
-            updatePanScrollState(view, eventHandler.lastKnownMousePosition());
+        if (LocalFrame* frame = m_autoscrollLayoutObject->frame()) {
+            if (FrameView* view = frame->view()) {
+                EventHandler& eventHandler = frame->eventHandler();
+                updatePanScrollState(view, eventHandler.lastKnownMousePosition());
+            }
+        }
         m_autoscrollLayoutObject->panScroll(m_panScrollStartPos);
         break;
 #endif
     }
     if (m_autoscrollType != NoAutoscroll && m_autoscrollLayoutObject)
         m_page->chromeClient().scheduleAnimation(m_autoscrollLayoutObject->frame()->view());
 }
 
 void AutoscrollController::startAutoscroll()
 {
@@ skipping 31 matching lines @@
         view->setCursor(eastPanningCursor());
     } else if (west) {
         view->setCursor(westPanningCursor());
     } else {
         view->setCursor(middlePanningCursor());
     }
 }
 #endif
 
 } // namespace blink