Protect against lifecycle updates that delete a layout object for autoscroll

third_party/WebKit/Source/core/html/HTMLSelectElement.cpp

 /*
  * Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies).
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
  * Copyright (C) 2004, 2005, 2006, 2007, 2009, 2010, 2011 Apple Inc. All rights
  * reserved.
  *           (C) 2006 Alexey Proskuryakov (ap@nypop.com)
  * Copyright (C) 2010 Google Inc. All rights reserved.
  * Copyright (C) 2009 Torch Mobile Inc. All rights reserved.
@@ skipping 1500 matching lines @@
     }
 
   } else if (event->type() == EventTypeNames::mousemove &&
              event->IsMouseEvent()) {
     MouseEvent* mouse_event = ToMouseEvent(event);
     if (mouse_event->button() !=
             static_cast<short>(WebPointerProperties::Button::kLeft) ||
         !mouse_event->ButtonDown())
       return;
 
-    if (Page* page = GetDocument().GetPage())
+    if (LayoutObject* object = GetLayoutObject())
+      object->GetFrameView()->UpdateAllLifecyclePhasesExceptPaint();
+
+    if (Page* page = GetDocument().GetPage()) {
       page->GetAutoscrollController().StartAutoscrollForSelection(
           GetLayoutObject());
+    }
     // Mousedown didn't happen in this element.
     if (last_on_change_selection_.IsEmpty())
       return;
 
     if (HTMLOptionElement* option = EventTargetOption(*mouse_event)) {
       if (!IsDisabledFormControl()) {
         if (is_multiple_) {
           // Only extend selection if there is something selected.
           if (!active_selection_anchor_)
             return;
@@ skipping 521 matching lines @@
   popup_updater_ = nullptr;
 }
 
 void HTMLSelectElement::DidMutateSubtree() {
   DCHECK(PopupIsVisible());
   DCHECK(popup_);
   popup_->UpdateFromElement(PopupMenu::kByDOMChange);
 }
 
 }  // namespace blink