Prevent a crash by caching overflow scrolling.

Use adoptRef when creating a new bridge item.  Use
toRenderBoxModelObject instead of toRenderBox as RenderInlines have layers.

Bug: 3321493

Change-Id: I4283681eba961aedaa8d80bfdfb3d1a468aab1ac

2 files changed, 3 insertions, 3 deletions

diff --git a/WebKit/android/jni/WebHistory.cpp b/WebKit/android/jni/WebHistory.cpp
index d3893ff..04d5e4e 100644
--- a/WebKit/android/jni/WebHistory.cpp
+++ b/WebKit/android/jni/WebHistory.cpp
@@ -168,7 +168,7 @@ static void WebHistoryInflate(JNIEnv* env, jobject obj, jint frame, jbyteArray d
     // Inflate the history tree into one HistoryItem or null if the inflation
     // failed.
     RefPtr<WebCore::HistoryItem> newItem = WebCore::HistoryItem::create();
-    RefPtr<WebHistoryItem> bridge = new WebHistoryItem(env, obj, newItem.get());
+    RefPtr<WebHistoryItem> bridge = adoptRef(new WebHistoryItem(env, obj, newItem.get()));
     newItem->setBridge(bridge.get());
 
     // Inflate the item recursively. If it fails, that is ok. We'll have an
diff --git a/WebKit/android/nav/CacheBuilder.cpp b/WebKit/android/nav/CacheBuilder.cpp
index ea436e7..40b2711 100644
--- a/WebKit/android/nav/CacheBuilder.cpp
+++ b/WebKit/android/nav/CacheBuilder.cpp
@@ -1117,7 +1117,7 @@ void CacheBuilder::BuildFrame(Frame* root, Frame* frame,
 #if USE(ACCELERATED_COMPOSITING)
             // If this renderer has its own layer and the layer is composited,
             // start tracking it.
-            if (lastChild && nodeRenderer->hasLayer() && toRenderBox(nodeRenderer)->layer()->backing())
+            if (lastChild && nodeRenderer->hasLayer() && toRenderBoxModelObject(nodeRenderer)->layer()->backing())
                 TrackLayer(layerTracker, nodeRenderer, lastChild, globalOffsetX, globalOffsetY);
 #endif
         }
@@ -2916,7 +2916,7 @@ void CacheBuilder::TrackLayer(WTF::Vector<LayerTracker>& layerTracker,
     IntPoint scroll(layer->scrollXOffset(), layer->scrollYOffset());
 #if ENABLE(ANDROID_OVERFLOW_SCROLL)
     // If this is an overflow element, track the content layer.
-    if (layer->hasOverflowScroll())
+    if (layer->hasOverflowScroll() && aLayer->getChild(0))
         aLayer = aLayer->getChild(0)->getChild(0);
     if (!aLayer)
         return;