Harden FrameSelection methods against JS running inside recalcStyle

Source/core/editing/FrameSelection.cpp

Index: Source/core/editing/FrameSelection.cpp
diff --git a/Source/core/editing/FrameSelection.cpp b/Source/core/editing/FrameSelection.cpp
index 2612860755ac4f5ff1a9c60394ad1003990fd77e..3741a185fcd07ac49cbf56be9af79e91b2aec2ef 100644
--- a/Source/core/editing/FrameSelection.cpp
+++ b/Source/core/editing/FrameSelection.cpp
@@ -1552,10 +1552,13 @@ void FrameSelection::focusedOrActiveStateChanged()
 {
     bool activeAndFocused = isFocusedAndActive();
 
+    RefPtr<Document> document = m_frame->document();
+    document->updateStyleIfNeeded();
+
     // Because RenderObject::selectionBackgroundColor() and
     // RenderObject::selectionForegroundColor() check if the frame is active,
     // we have to update places those colors were painted.
-    if (RenderView* view = m_frame->document()->renderView())

[abarth-chromium, 2013/09/27 22:55:00]

Should we bail out at some point if the document leaves the frame?

+    if (RenderView* view = document->renderView())
         view->repaintSelection();
 
     // Caret appears in the active frame.
@@ -1571,7 +1574,7 @@ void FrameSelection::focusedOrActiveStateChanged()
     // Because StyleResolver::checkOneSelector() and
     // RenderTheme::isFocused() check if the frame is active, we have to
     // update style and theme state that depended on those.
-    if (Element* element = m_frame->document()->focusedElement()) {
+    if (Element* element = document->focusedElement()) {
         element->setNeedsStyleRecalc();
         if (RenderObject* renderer = element->renderer()) {
             if (renderer && renderer->style()->hasAppearance())
@@ -1580,7 +1583,7 @@ void FrameSelection::focusedOrActiveStateChanged()
     }
 
     // Secure keyboard entry is set by the active frame.
-    if (m_frame->document()->useSecureKeyboardEntryWhenActive())
+    if (document->useSecureKeyboardEntryWhenActive())
         setUseSecureKeyboardEntry(activeAndFocused);
 }
 
@@ -1822,12 +1825,15 @@ bool FrameSelection::shouldDeleteSelection(const VisibleSelection& selection) co
 
 FloatRect FrameSelection::bounds(bool clipToVisibleContent) const
 {
-    RenderView* root = m_frame->contentRenderer();
+    m_frame->document()->updateStyleIfNeeded();
+
     FrameView* view = m_frame->view();
-    if (!root || !view)
-        return LayoutRect();
+    RenderView* renderView = m_frame->contentRenderer();
+
+    if (!view || !renderView);
+        return FloatRect();
 
-    LayoutRect selectionRect = root->selectionBounds(clipToVisibleContent);
+    LayoutRect selectionRect = renderView->selectionBounds(clipToVisibleContent);
     return clipToVisibleContent ? intersection(selectionRect, view->visibleContentRect()) : selectionRect;
 }