Protect against lifecycle updates that delete a layout object for autoscroll

third_party/WebKit/Source/core/html/HTMLSelectElement.cpp

 /*
  * Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies).
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
  * Copyright (C) 2004, 2005, 2006, 2007, 2009, 2010, 2011 Apple Inc. All rights
  * reserved.
  *           (C) 2006 Alexey Proskuryakov (ap@nypop.com)
  * Copyright (C) 2010 Google Inc. All rights reserved.
  * Copyright (C) 2009 Torch Mobile Inc. All rights reserved.
@@ skipping 1500 matching lines @@
     }
 
   } else if (event->type() == EventTypeNames::mousemove &&
              event->IsMouseEvent()) {
     MouseEvent* mouse_event = ToMouseEvent(event);
     if (mouse_event->button() !=
             static_cast<short>(WebPointerProperties::Button::kLeft) ||
         !mouse_event->ButtonDown())
       return;
 
+    if (LayoutObject* object = GetLayoutObject())

[mstensho (USE GERRIT), 2017/04/26 09:46:28]

I don't know if it matters, or if it's possible at all, but what if we don't
have a layout object here? Should we still call
UpdateAllLifecyclePhasesExceptPaint(), perhaps?

[chrishtr, 2017/04/26 23:11:06]

StartAutoscrollForSelection will be a no-op if layout_object is null, so it's ok
to not run
the lifecycle.

[mstensho (USE GERRIT), 2017/04/27 20:16:11]

I was more thinking of the possibility of a layout object appearing for the
select element if you run the life cycle. But yeah, that does sound weird and
useless, so fine. :)

+      object->GetFrameView()->UpdateAllLifecyclePhasesExceptPaint();
+
     if (Page* page = GetDocument().GetPage())
       page->GetAutoscrollController().StartAutoscrollForSelection(
           GetLayoutObject());
     // Mousedown didn't happen in this element.
     if (last_on_change_selection_.IsEmpty())
       return;
 
     if (HTMLOptionElement* option = EventTargetOption(*mouse_event)) {
       if (!IsDisabledFormControl()) {
         if (is_multiple_) {
@@ skipping 524 matching lines @@
   popup_updater_ = nullptr;
 }
 
 void HTMLSelectElement::DidMutateSubtree() {
   DCHECK(PopupIsVisible());
   DCHECK(popup_);
   popup_->UpdateFromElement(PopupMenu::kByDOMChange);
 }
 
 }  // namespace blink