Harden FrameSelection methods against JS running inside recalcStyle

Source/core/editing/FrameSelection.cpp

Index: Source/core/editing/FrameSelection.cpp
diff --git a/Source/core/editing/FrameSelection.cpp b/Source/core/editing/FrameSelection.cpp
index e46026afaf4f21d823ef1fb65e17e9be62f313ad..9e3768f1fb96d0d0d762e7a6de34c47cf6133a42 100644
--- a/Source/core/editing/FrameSelection.cpp
+++ b/Source/core/editing/FrameSelection.cpp
@@ -1540,10 +1540,13 @@ void FrameSelection::focusedOrActiveStateChanged()
 {
     bool activeAndFocused = isFocusedAndActive();
 
+    RefPtr<Document> document = m_frame->document();
+    document->updateStyleIfNeeded();
+
     // Because RenderObject::selectionBackgroundColor() and
     // RenderObject::selectionForegroundColor() check if the frame is active,
     // we have to update places those colors were painted.
-    if (RenderView* view = m_frame->document()->renderView())
+    if (RenderView* view = document->renderView())
         view->repaintSelection();
 
     // Caret appears in the active frame.
@@ -1559,7 +1562,7 @@ void FrameSelection::focusedOrActiveStateChanged()
     // Because StyleResolver::checkOneSelector() and
     // RenderTheme::isFocused() check if the frame is active, we have to
     // update style and theme state that depended on those.
-    if (Element* element = m_frame->document()->focusedElement()) {
+    if (Element* element = document->focusedElement()) {
         element->setNeedsStyleRecalc();
         if (RenderObject* renderer = element->renderer()) {
             if (renderer && renderer->style()->hasAppearance())
@@ -1568,7 +1571,7 @@ void FrameSelection::focusedOrActiveStateChanged()
     }
 
     // Secure keyboard entry is set by the active frame.
-    if (m_frame->document()->useSecureKeyboardEntryWhenActive())
+    if (document->useSecureKeyboardEntryWhenActive())
         setUseSecureKeyboardEntry(activeAndFocused);
 }
 
@@ -1805,12 +1808,15 @@ String FrameSelection::selectedTextForClipboard() const
 
 FloatRect FrameSelection::bounds(bool clipToVisibleContent) const
 {
-    RenderView* root = m_frame->contentRenderer();
+    m_frame->document()->updateStyleIfNeeded();
+
     FrameView* view = m_frame->view();
-    if (!root || !view)
-        return LayoutRect();
+    RenderView* renderView = m_frame->contentRenderer();
+
+    if (!view || !renderView)
+        return FloatRect();
 
-    LayoutRect selectionRect = root->selectionBounds(clipToVisibleContent);
+    LayoutRect selectionRect = renderView->selectionBounds(clipToVisibleContent);
     return clipToVisibleContent ? intersection(selectionRect, view->visibleContentRect()) : selectionRect;
 }