am 2b6ea029: Cherry-pick WebKit change 60984 to fix an exploitable crash when focus is changed

Merge commit '2b6ea0299b0340ff815b7beab6e7491ff5e4d6c0' into gingerbread

* commit '2b6ea0299b0340ff815b7beab6e7491ff5e4d6c0':
  Cherry-pick WebKit change 60984 to fix an exploitable crash when focus is changed

1 files changed, 5 insertions, 1 deletions

diff --git a/WebCore/dom/Element.cpp b/WebCore/dom/Element.cpp
index 0a1bc75..e12d326 100644
--- a/WebCore/dom/Element.cpp
+++ b/WebCore/dom/Element.cpp
@@ -1259,8 +1259,12 @@ void Element::focus(bool restorePreviousSelection)
             return;
     }
 
-    if (Page* page = doc->page())
+    RefPtr<Node> protect;
+    if (Page* page = doc->page()) {
+        // Focus and change event handlers can cause us to lose our last ref.
+        protect = this;
         page->focusController()->setFocusedNode(this, doc->frame());
+    }
 
     // Setting the focused node above might have invalidated the layout due to scripts.
     doc->updateLayoutIgnorePendingStylesheets();