Fix a crash in HTMLFormElement::reset() due to <output>.

Fix a crash in HTMLFormElement::reset() due to <output>.

BUG=675237
Committed: https://crrev.com/44dd7c1b6106ea96ad8bd134e21f4d933cfda1c0
Cr-Commit-Position: refs/heads/master@{#439984}

[tkent, 2016-12-20 06:04:57]

The CQ bit was checked by tkent@chromium.org to run a CQ dry run

[commit-bot: I haz the power, 2016-12-20 06:05:16]

Dry run: CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[tkent, 2016-12-20 08:33:45]

tkent@chromium.org changed reviewers:
+ kochi@chromium.org

[tkent, 2016-12-20 08:33:46]

kochi@, would you review this please?

[commit-bot: I haz the power, 2016-12-20 08:49:43]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2016-12-20 08:49:44]

Dry run: Try jobs failed on following builders:
  linux_chromium_rel_ng on master.tryserver.chromium.linux (JOB_FAILED,
http://build.chromium.org/p/tryserver.chromium.linux/builders/linux_chromium_...)

[kochi, 2016-12-21 01:45:58]

https://codereview.chromium.org/2588293002/diff/1/third_party/WebKit/Source/c...
File third_party/WebKit/Source/core/html/HTMLFormElement.cpp (right):

https://codereview.chromium.org/2588293002/diff/1/third_party/WebKit/Source/c...
third_party/WebKit/Source/core/html/HTMLFormElement.cpp:469: // structure.
Is it guaranteed that none of |elements| will be disconnected/
deleted?  Or Oilpan keeps these objects alive?

[tkent, 2016-12-21 02:13:31]

https://codereview.chromium.org/2588293002/diff/1/third_party/WebKit/Source/c...
File third_party/WebKit/Source/core/html/HTMLFormElement.cpp (right):

https://codereview.chromium.org/2588293002/diff/1/third_party/WebKit/Source/c...
third_party/WebKit/Source/core/html/HTMLFormElement.cpp:469: // structure.
On 2016/12/21 at 01:45:58, kochi wrote:
> Is it guaranteed that none of |elements| will be disconnected/
> deleted?  Or Oilpan keeps these objects alive?

An element can be disconnected, but it keeps alive because it's on an Oilpan
heap collection.
Before this CL, I think the backing store of HeapVector of listedElements() is
immediately deallocated by DOM structure change.

[kochi, 2016-12-21 02:20:05]

lgtm

https://codereview.chromium.org/2588293002/diff/1/third_party/WebKit/Source/c...
File third_party/WebKit/Source/core/html/HTMLFormElement.cpp (right):

https://codereview.chromium.org/2588293002/diff/1/third_party/WebKit/Source/c...
third_party/WebKit/Source/core/html/HTMLFormElement.cpp:469: // structure.
On 2016/12/21 02:13:31, tkent wrote:
> On 2016/12/21 at 01:45:58, kochi wrote:
> > Is it guaranteed that none of |elements| will be disconnected/
> > deleted?  Or Oilpan keeps these objects alive?
> 
> An element can be disconnected, but it keeps alive because it's on an Oilpan
> heap collection.
> Before this CL, I think the backing store of HeapVector of listedElements() is
> immediately deallocated by DOM structure change. 

I see, thanks for the explanation!

[tkent, 2016-12-21 02:21:20]

The CQ bit was checked by tkent@chromium.org

[commit-bot: I haz the power, 2016-12-21 02:21:57]

CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[commit-bot: I haz the power, 2016-12-21 02:31:03]

CQ is committing da patch.

Bot data: {"patchset_id": 1, "attempt_start_ts": 1482286880229060, "parent_rev":
"c4ed089ed0ee564814a32d78fe828c6ff53cfbec", "commit_rev":
"74a09f5925f6f68e0a928a53ad0fa0bc97517925"}

[commit-bot: I haz the power, 2016-12-21 02:31:28]

Description was changed from

==========
Fix a crash in HTMLFormElement::reset() due to <output>.

BUG=675237
==========

to

==========
Fix a crash in HTMLFormElement::reset() due to <output>.

BUG=675237

Review-Url: https://codereview.chromium.org/2588293002
==========

[commit-bot: I haz the power, 2016-12-21 02:31:30]

Committed patchset #1 (id:1)

[commit-bot: I haz the power, 2016-12-21 02:33:07]

Description was changed from

==========
Fix a crash in HTMLFormElement::reset() due to <output>.

BUG=675237

Review-Url: https://codereview.chromium.org/2588293002
==========

to

==========
Fix a crash in HTMLFormElement::reset() due to <output>.

BUG=675237

Committed: https://crrev.com/44dd7c1b6106ea96ad8bd134e21f4d933cfda1c0
Cr-Commit-Position: refs/heads/master@{#439984}
==========

[commit-bot: I haz the power, 2016-12-21 02:33:08]

Patchset 1 (id:??) landed as
https://crrev.com/44dd7c1b6106ea96ad8bd134e21f4d933cfda1c0
Cr-Commit-Position: refs/heads/master@{#439984}