Protect against lifecycle updates that delete a layout object for autoscroll

third_party/WebKit/Source/core/html/HTMLSelectElement.cpp

Index: third_party/WebKit/Source/core/html/HTMLSelectElement.cpp
diff --git a/third_party/WebKit/Source/core/html/HTMLSelectElement.cpp b/third_party/WebKit/Source/core/html/HTMLSelectElement.cpp
index d843d29162b0f2941283580ddfb6218e1a5e8c40..e1939d2810f9dbf8e66091459837246d84d0b66d 100644
--- a/third_party/WebKit/Source/core/html/HTMLSelectElement.cpp
+++ b/third_party/WebKit/Source/core/html/HTMLSelectElement.cpp
@@ -1518,6 +1518,9 @@ void HTMLSelectElement::ListBoxDefaultEventHandler(Event* event) {
         !mouse_event->ButtonDown())
       return;
 
+    if (LayoutObject* object = GetLayoutObject())

[mstensho (USE GERRIT), 2017/04/26 09:46:28]

I don't know if it matters, or if it's possible at all, but what if we don't
have a layout object here? Should we still call
UpdateAllLifecyclePhasesExceptPaint(), perhaps?

[chrishtr, 2017/04/26 23:11:06]

StartAutoscrollForSelection will be a no-op if layout_object is null, so it's ok
to not run
the lifecycle.

[mstensho (USE GERRIT), 2017/04/27 20:16:11]

I was more thinking of the possibility of a layout object appearing for the
select element if you run the life cycle. But yeah, that does sound weird and
useless, so fine. :)

+      object->GetFrameView()->UpdateAllLifecyclePhasesExceptPaint();
+
     if (Page* page = GetDocument().GetPage())
       page->GetAutoscrollController().StartAutoscrollForSelection(
           GetLayoutObject());