Fix crash in blink::DOMWindowEventQueue::close

Source/core/events/DOMWindowEventQueue.cpp

 /*
  * Copyright (C) 2010 Google Inc. All Rights Reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 91 matching lines @@
         m_pendingEventTimer->stop();
     return found;
 }
 
 void DOMWindowEventQueue::close()
 {
     m_isClosed = true;
     m_pendingEventTimer->stop();
     if (InspectorInstrumentation::hasFrontends()) {
         WillBeHeapListHashSet<RefPtrWillBeMember<Event>, 16>::iterator it = m_queuedEvents.begin();
-        for (; it != m_queuedEvents.end(); ++it)
-            InspectorInstrumentation::didRemoveEvent((*it)->target(), it->get());
+        for (; it != m_queuedEvents.end(); ++it) {
+            RefPtrWillBeRawPtr<Event> event = *it;
+            if (event)
+                InspectorInstrumentation::didRemoveEvent(event->target(), event.get());
+        }
     }
     m_queuedEvents.clear();
 }
 
 void DOMWindowEventQueue::pendingEventTimerFired()
 {
     ASSERT(!m_pendingEventTimer->isActive());
     ASSERT(!m_queuedEvents.isEmpty());
 
     // Insert a marker for where we should stop.
     ASSERT(!m_queuedEvents.contains(nullptr));
     bool wasAdded = m_queuedEvents.add(nullptr).isNewEntry;

[aandrey, 2014/08/08 14:07:02]

there can be NULL's in the queue, thus the crash

     ASSERT_UNUSED(wasAdded, wasAdded); // It should not have already been in the list.
 
     RefPtrWillBeRawPtr<DOMWindowEventQueue> protector(this);
 
     while (!m_queuedEvents.isEmpty()) {
         WillBeHeapListHashSet<RefPtrWillBeMember<Event>, 16>::iterator iter = m_queuedEvents.begin();
         RefPtrWillBeRawPtr<Event> event = *iter;
         m_queuedEvents.remove(iter);
         if (!event)
             break;
         dispatchEvent(event.get());
         InspectorInstrumentation::didRemoveEvent(event->target(), event.get());
     }
 }
 
 void DOMWindowEventQueue::dispatchEvent(PassRefPtrWillBeRawPtr<Event> event)
 {
     EventTarget* eventTarget = event->target();
     if (eventTarget->toDOMWindow())
         eventTarget->toDOMWindow()->dispatchEvent(event, nullptr);
     else
         eventTarget->dispatchEvent(event);
 }
 
 }