Fix a crash in HTMLFormElement::reset() due to <output>.

third_party/WebKit/Source/core/html/HTMLFormElement.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
  * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights
  * reserved.
  *           (C) 2006 Alexey Proskuryakov (ap@nypop.com)
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ skipping 447 matching lines @@
     return;
 
   m_isInResetFunction = true;
 
   if (dispatchEvent(Event::createCancelableBubble(EventTypeNames::reset)) !=
       DispatchEventResult::NotCanceled) {
     m_isInResetFunction = false;
     return;
   }
 
-  for (const auto& element : listedElements()) {
+  // Copy the element list because |reset()| implementation can update DOM
+  // structure.

[kochi, 2016/12/21 01:45:58]

Is it guaranteed that none of |elements| will be disconnected/
deleted?  Or Oilpan keeps these objects alive?

[tkent, 2016/12/21 02:13:31]

An element can be disconnected, but it keeps alive because it's on an Oilpan
heap collection.
Before this CL, I think the backing store of HeapVector of listedElements() is
immediately deallocated by DOM structure change. 

[kochi, 2016/12/21 02:20:05]

I see, thanks for the explanation!

+  ListedElement::List elements(listedElements());
+  for (const auto& element : elements) {
     if (element->isFormControlElement())
       toHTMLFormControlElement(element)->reset();
   }
 
   m_isInResetFunction = false;
 }
 
 void HTMLFormElement::parseAttribute(const QualifiedName& name,
                                      const AtomicString& oldValue,
                                      const AtomicString& value) {
@@ skipping 325 matching lines @@
   for (const auto& control : listedElements()) {
     if (!control->isFormControlElement())
       continue;
     if (toHTMLFormControlElement(control)->canBeSuccessfulSubmitButton())
       toHTMLFormControlElement(control)->pseudoStateChanged(
           CSSSelector::PseudoDefault);
   }
 }
 
 }  // namespace blink