INPUT element: avoid crash in EventDispatcher::dispatchEventPostProcess().

third_party/WebKit/Source/core/events/EventDispatcher.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
  * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009, 2010, 2011 Apple Inc. All
  * rights reserved.
  * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
  * Copyright (C) 2009 Torch Mobile Inc. All rights reserved.
  * (http://www.torchmobile.com/)
  * Copyright (C) 2011 Google Inc. All rights reserved.
@@ skipping 225 matching lines @@
   // https://dom.spec.whatwg.org/#concept-event-dispatch
   // 14. Unset event’s dispatch flag, stop propagation flag, and stop immediate
   // propagation flag.
   m_event->setStopPropagation(false);
   m_event->setStopImmediatePropagation(false);
   // 15. Set event’s eventPhase attribute to NONE.
   m_event->setEventPhase(0);
   // 16. Set event’s currentTarget attribute to null.
   m_event->setCurrentTarget(nullptr);
 
-  // Pass the data from the preDispatchEventHandler to the
-  // postDispatchEventHandler.
-  m_node->postDispatchEventHandler(m_event.get(),
-                                   preDispatchEventHandlerResult);
-
   bool isClick = m_event->isMouseEvent() &&
                  toMouseEvent(*m_event).type() == EventTypeNames::click;
   if (isClick) {
     // Fire an accessibility event indicating a node was clicked on.  This is
     // safe if m_event->target()->toNode() returns null.
     if (AXObjectCache* cache = m_node->document().existingAXObjectCache())
       cache->handleClicked(m_event->target()->toNode());
   }
 
+  // Pass the data from the preDispatchEventHandler to the
+  // postDispatchEventHandler.
+  // This may dispatch an event, and m_node and m_event might be altered.
+  m_node->postDispatchEventHandler(m_event.get(),
+                                   preDispatchEventHandlerResult);
+  // TODO(tkent): Is it safe to kick defaultEventHandler() with such altered
+  // m_event?
+
   // The DOM Events spec says that events dispatched by JS (other than "click")
   // should not have their default handlers invoked.
   bool isTrustedOrClick =
       !RuntimeEnabledFeatures::trustedEventsDefaultActionEnabled() ||
       m_event->isTrusted() || isClick;
 
   // For Android WebView (distinguished by wideViewportQuirkEnabled)
   // enable untrusted events for mouse down on select elements because
   // fastclick.js seems to generate these. crbug.com/642698
   // TODO(dtapuska): Change this to a target SDK quirk crbug.com/643705
@@ skipping 34 matching lines @@
   // events to open select boxes.
   if (!m_event->isTrusted() && m_event->isMouseEvent() &&
       m_event->type() == EventTypeNames::mousedown &&
       isHTMLSelectElement(*m_node)) {
     UseCounter::count(m_node->document(),
                       UseCounter::UntrustedMouseDownEventDispatchedToSelect);
   }
 }
 
 }  // namespace blink