Protect against lifecycle updates that delete a layout object for autoscroll

third_party/WebKit/Source/core/input/MouseEventManager.cpp

 // Copyright 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "core/input/MouseEventManager.h"
 
 #include "core/clipboard/DataObject.h"
 #include "core/clipboard/DataTransfer.h"
 #include "core/dom/Element.h"
 #include "core/dom/ElementTraversal.h"
@@ skipping 720 matching lines @@
     if (!layout_object || !layout_object->IsListBox())
       return WebInputEventResult::kNotHandled;
   }
 
   mouse_down_may_start_drag_ = false;
 
   frame_->GetEventHandler().GetSelectionController().HandleMouseDraggedEvent(
       event, mouse_down_pos_, drag_start_pos_, mouse_press_node_.Get(),
       last_known_mouse_position_);
 
-  // The call into handleMouseDraggedEvent may have caused a re-layout,
+  // The call into HandleMouseDraggedEvent may have caused a re-layout,
   // so get the LayoutObject again.
   layout_object = target_node->GetLayoutObject();
 
   if (layout_object && mouse_down_may_start_autoscroll_ &&
       !scroll_manager_->MiddleClickAutoscrollInProgress() &&
       !frame_->Selection().SelectedHTMLForClipboard().IsEmpty()) {
     if (AutoscrollController* controller =
             scroll_manager_->GetAutoscrollController()) {
-      controller->StartAutoscrollForSelection(layout_object);
-      mouse_down_may_start_autoscroll_ = false;
+      layout_object->GetFrameView()->UpdateAllLifecyclePhasesExceptPaint();
+
+      // The lifecycle update above may have invalidated the previous layout.
+      if (LayoutObject* next_layout_object = target_node->GetLayoutObject()) {
+        controller->StartAutoscrollForSelection(next_layout_object);
+        mouse_down_may_start_autoscroll_ = false;
+      }
     }
   }
 
   return WebInputEventResult::kHandledSystem;
 }
 
 bool MouseEventManager::HandleDrag(const MouseEventWithHitTestResults& event,
                                    DragInitiator initiator) {
   DCHECK(event.Event().GetType() == WebInputEvent::kMouseMove);
   // Callers must protect the reference to FrameView, since this function may
@@ skipping 263 matching lines @@
 
 void MouseEventManager::SetClickCount(int click_count) {
   click_count_ = click_count;
 }
 
 bool MouseEventManager::MouseDownMayStartDrag() {
   return mouse_down_may_start_drag_;
 }
 
 }  // namespace blink