Protect against lifecycle updates that delete a layout object for autoscroll

third_party/WebKit/Source/core/html/HTMLSelectElement.cpp

Index: third_party/WebKit/Source/core/html/HTMLSelectElement.cpp
diff --git a/third_party/WebKit/Source/core/html/HTMLSelectElement.cpp b/third_party/WebKit/Source/core/html/HTMLSelectElement.cpp
index d843d29162b0f2941283580ddfb6218e1a5e8c40..1146827baf9dcef6169ed536298bd72dbff616aa 100644
--- a/third_party/WebKit/Source/core/html/HTMLSelectElement.cpp
+++ b/third_party/WebKit/Source/core/html/HTMLSelectElement.cpp
@@ -1518,9 +1518,13 @@ void HTMLSelectElement::ListBoxDefaultEventHandler(Event* event) {
         !mouse_event->ButtonDown())
       return;
 
-    if (Page* page = GetDocument().GetPage())
+    if (LayoutObject* object = GetLayoutObject())
+      object->GetFrameView()->UpdateAllLifecyclePhasesExceptPaint();
+
+    if (Page* page = GetDocument().GetPage()) {
       page->GetAutoscrollController().StartAutoscrollForSelection(
           GetLayoutObject());
+    }
     // Mousedown didn't happen in this element.
     if (last_on_change_selection_.IsEmpty())
       return;