INPUT element: avoid crash in EventDispatcher::dispatchEventPostProcess().

third_party/WebKit/Source/core/events/EventDispatcher.cpp

Index: third_party/WebKit/Source/core/events/EventDispatcher.cpp
diff --git a/third_party/WebKit/Source/core/events/EventDispatcher.cpp b/third_party/WebKit/Source/core/events/EventDispatcher.cpp
index c89649f3c44697088bd24e4a20ce8274dc907697..dafd657b6d9d2bf08914fa1efbbed7e067bd96b6 100644
--- a/third_party/WebKit/Source/core/events/EventDispatcher.cpp
+++ b/third_party/WebKit/Source/core/events/EventDispatcher.cpp
@@ -243,11 +243,6 @@ inline void EventDispatcher::dispatchEventPostProcess(
   // 16. Set event’s currentTarget attribute to null.
   m_event->setCurrentTarget(nullptr);
 
-  // Pass the data from the preDispatchEventHandler to the
-  // postDispatchEventHandler.
-  m_node->postDispatchEventHandler(m_event.get(),
-                                   preDispatchEventHandlerResult);
-
   bool isClick = m_event->isMouseEvent() &&
                  toMouseEvent(*m_event).type() == EventTypeNames::click;
   if (isClick) {
@@ -257,6 +252,14 @@ inline void EventDispatcher::dispatchEventPostProcess(
       cache->handleClicked(m_event->target()->toNode());
   }
 
+  // Pass the data from the preDispatchEventHandler to the
+  // postDispatchEventHandler.
+  // This may dispatch an event, and m_node and m_event might be altered.
+  m_node->postDispatchEventHandler(m_event.get(),
+                                   preDispatchEventHandlerResult);
+  // TODO(tkent): Is it safe to kick defaultEventHandler() with such altered
+  // m_event?
+
   // The DOM Events spec says that events dispatched by JS (other than "click")
   // should not have their default handlers invoked.
   bool isTrustedOrClick =