[Backport] Protect against lifecycle updates that delete a layout object for autoscroll.

NOPRESUBMIT=true
BUG=713190

Change-Id: Ic2c8243d78ef5ed3f147f8848e88e5306ef01ea3
Review-Url: https://codereview.chromium.org/2844593002
Cr-Commit-Position: refs/heads/master@{#468109}
Reviewed-by: Alexandru Croitor <alexandru.croitor@qt.io>

2 files changed, 11 insertions, 2 deletions

diff --git a/chromium/third_party/WebKit/Source/core/html/HTMLSelectElement.cpp b/chromium/third_party/WebKit/Source/core/html/HTMLSelectElement.cpp
index ad4c1d65e14..ab701167ec2 100644
--- a/chromium/third_party/WebKit/Source/core/html/HTMLSelectElement.cpp
+++ b/chromium/third_party/WebKit/Source/core/html/HTMLSelectElement.cpp
@@ -1551,6 +1551,9 @@ void HTMLSelectElement::listBoxDefaultEventHandler(Event* event)
         if (mouseEvent->button() != LeftButton || !mouseEvent->buttonDown())
             return;
 
+        if (LayoutObject* object = layoutObject())
+            object->frameView()->updateAllLifecyclePhases();
+
         if (Page* page = document().page())
             page->autoscrollController().startAutoscrollForSelection(layoutObject());
         // Mousedown didn't happen in this element.
diff --git a/chromium/third_party/WebKit/Source/core/input/EventHandler.cpp b/chromium/third_party/WebKit/Source/core/input/EventHandler.cpp
index 47861ee82ac..0daf6c4fa18 100644
--- a/chromium/third_party/WebKit/Source/core/input/EventHandler.cpp
+++ b/chromium/third_party/WebKit/Source/core/input/EventHandler.cpp
@@ -534,8 +534,14 @@ WebInputEventResult EventHandler::handleMouseDraggedEvent(const MouseEventWithHi
 
     if (m_mouseDownMayStartAutoscroll && !panScrollInProgress()) {
         if (AutoscrollController* controller = autoscrollController()) {
-            controller->startAutoscrollForSelection(layoutObject);
-            m_mouseDownMayStartAutoscroll = false;
+            // Avoid updating the lifecycle unless it's possible to autoscroll.
+            layoutObject->frameView()->updateAllLifecyclePhases();
+            // The lifecycle update above may have invalidated the previous layout.
+            layoutObject = targetNode->layoutObject();
+            if (layoutObject) {
+                controller->startAutoscrollForSelection(layoutObject);
+                m_mouseDownMayStartAutoscroll = false;
+            }
         }
     }