Fix a crash in HTMLFormElement::reset() due to <output>.

third_party/WebKit/Source/core/html/HTMLFormElement.cpp

Index: third_party/WebKit/Source/core/html/HTMLFormElement.cpp
diff --git a/third_party/WebKit/Source/core/html/HTMLFormElement.cpp b/third_party/WebKit/Source/core/html/HTMLFormElement.cpp
index fcfa50f06f51d6e20763e1ef9e31a106e1891503..7d3658d7f49ca4272e7104e5cbc088caddb60f5b 100644
--- a/third_party/WebKit/Source/core/html/HTMLFormElement.cpp
+++ b/third_party/WebKit/Source/core/html/HTMLFormElement.cpp
@@ -465,7 +465,10 @@ void HTMLFormElement::reset() {
     return;
   }
 
-  for (const auto& element : listedElements()) {
+  // Copy the element list because |reset()| implementation can update DOM
+  // structure.

[kochi, 2016/12/21 01:45:58]

Is it guaranteed that none of |elements| will be disconnected/
deleted?  Or Oilpan keeps these objects alive?

[tkent, 2016/12/21 02:13:31]

An element can be disconnected, but it keeps alive because it's on an Oilpan
heap collection.
Before this CL, I think the backing store of HeapVector of listedElements() is
immediately deallocated by DOM structure change. 

[kochi, 2016/12/21 02:20:05]

I see, thanks for the explanation!

+  ListedElement::List elements(listedElements());
+  for (const auto& element : elements) {
     if (element->isFormControlElement())
       toHTMLFormControlElement(element)->reset();
   }