Don't keep pointers to table sections when told to recalculate sections.

third_party/WebKit/Source/core/layout/LayoutTable.h

 /*
  * Copyright (C) 1997 Martin Jones (mjones@kde.org)
  *           (C) 1997 Torben Weis (weis@kde.org)
  *           (C) 1998 Waldo Bastian (bastian@kde.org)
  *           (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  * Copyright (C) 2003, 2004, 2005, 2006, 2009, 2010 Apple Inc.
  *               All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
@@ skipping 234 matching lines @@
   }
   void setEffectiveColumnPosition(unsigned index, int position) {
     // Note that if our horizontal border-spacing changed, our position will
     // change but not our column's width. In practice, horizontal border-spacing
     // won't change often.
     m_columnLogicalWidthChanged |=
         m_effectiveColumnPositions[index] != position;
     m_effectiveColumnPositions[index] = position;
   }
 
-  LayoutTableSection* header() const { return m_head; }
-  LayoutTableSection* footer() const { return m_foot; }
-  LayoutTableSection* firstBody() const { return m_firstBody; }
+  LayoutTableSection* header() const {
+    // TODO(mstensho): We should ideally DCHECK(!needsSectionRecalc()) here, but
+    // we currently cannot, due to crbug.com/693212
+    return m_head;
+  }
+  LayoutTableSection* footer() const {
+    DCHECK(!needsSectionRecalc());
+    return m_foot;
+  }
+  LayoutTableSection* firstBody() const {
+    DCHECK(!needsSectionRecalc());
+    return m_firstBody;
+  }
 
   void setRowOffsetFromRepeatingHeader(LayoutUnit offset) {
     m_rowOffsetFromRepeatingHeader = offset;
   }
   LayoutUnit rowOffsetFromRepeatingHeader() const {
     return m_rowOffsetFromRepeatingHeader;
   }
 
   // This function returns 0 if the table has no section.
   LayoutTableSection* topSection() const;
@@ skipping 92 matching lines @@
     // fast.
     if (!m_hasColElements)
       return ColAndColGroup();
     return slowColElementAtAbsoluteColumn(absoluteColumnIndex);
   }
 
   bool needsSectionRecalc() const { return m_needsSectionRecalc; }
   void setNeedsSectionRecalc() {
     if (documentBeingDestroyed())
       return;
+    // For all we know, sections may have been deleted at this point. Don't
+    // keep pointers dangling around.
+    m_head = nullptr;
+    m_foot = nullptr;
+    m_firstBody = nullptr;
+
     m_needsSectionRecalc = true;
     setNeedsLayoutAndFullPaintInvalidation(
         LayoutInvalidationReason::TableChanged);
   }
 
   LayoutTableSection* sectionAbove(
       const LayoutTableSection*,
       SkipEmptySectionsValue = DoNotSkipEmptySections) const;
   LayoutTableSection* sectionBelow(
       const LayoutTableSection*,
       SkipEmptySectionsValue = DoNotSkipEmptySections) const;
 
   LayoutTableCell* cellAbove(const LayoutTableCell*) const;
   LayoutTableCell* cellBelow(const LayoutTableCell*) const;
   LayoutTableCell* cellBefore(const LayoutTableCell*) const;
   LayoutTableCell* cellAfter(const LayoutTableCell*) const;
 
   typedef Vector<CollapsedBorderValue> CollapsedBorderValues;
   void invalidateCollapsedBorders();
 
-  bool hasSections() const { return m_head || m_foot || m_firstBody; }
+  bool hasSections() const { return header() || footer() || firstBody(); }
 
   void recalcSectionsIfNeeded() const {
     if (m_needsSectionRecalc)
       recalcSections();
   }
 
   static LayoutTable* createAnonymousWithParent(const LayoutObject*);
   LayoutBox* createAnonymousBoxWithSameTypeAs(
       const LayoutObject* parent) const override {
     return createAnonymousWithParent(parent);
@@ skipping 191 matching lines @@
   if (m_firstBody)
     return m_firstBody;
   return m_foot;
 }
 
 DEFINE_LAYOUT_OBJECT_TYPE_CASTS(LayoutTable, isTable());
 
 }  // namespace blink
 
 #endif  // LayoutTable_h