Protect against lifecycle updates that delete a layout object for autoscroll

third_party/WebKit/Source/core/input/MouseEventManager.cpp

Index: third_party/WebKit/Source/core/input/MouseEventManager.cpp
diff --git a/third_party/WebKit/Source/core/input/MouseEventManager.cpp b/third_party/WebKit/Source/core/input/MouseEventManager.cpp
index bb8830402e73d69301d291bfbb1026d431ac415c..ee3de2fd7e16001c4e98c6baaa0896d032bfda16 100644
--- a/third_party/WebKit/Source/core/input/MouseEventManager.cpp
+++ b/third_party/WebKit/Source/core/input/MouseEventManager.cpp
@@ -738,7 +738,7 @@ WebInputEventResult MouseEventManager::HandleMouseDraggedEvent(
       event, mouse_down_pos_, drag_start_pos_, mouse_press_node_.Get(),
       last_known_mouse_position_);
 
-  // The call into handleMouseDraggedEvent may have caused a re-layout,
+  // The call into HandleMouseDraggedEvent may have caused a re-layout,
   // so get the LayoutObject again.
   layout_object = target_node->GetLayoutObject();
 
@@ -747,8 +747,14 @@ WebInputEventResult MouseEventManager::HandleMouseDraggedEvent(
       !frame_->Selection().SelectedHTMLForClipboard().IsEmpty()) {
     if (AutoscrollController* controller =
             scroll_manager_->GetAutoscrollController()) {
-      controller->StartAutoscrollForSelection(layout_object);
-      mouse_down_may_start_autoscroll_ = false;
+      // Avoid updating the lifecycle unless it's possible to autoscroll.
+      layout_object->GetFrameView()->UpdateAllLifecyclePhasesExceptPaint();
+
+      // The lifecycle update above may have invalidated the previous layout.
+      if (LayoutObject* next_layout_object = target_node->GetLayoutObject()) {

[mstensho (USE GERRIT), 2017/04/27 20:16:11]

I suppose you could also re-use layout_object, instead of keeping a pointer to a
potentially dead object around?

[chrishtr, 2017/04/28 02:21:34]

Done.

+        controller->StartAutoscrollForSelection(next_layout_object);
+        mouse_down_may_start_autoscroll_ = false;
+      }
     }
   }