angler-fishThe Vulnerability History Project

UpdateWidget() can fire beforeload event synchronously blowing away RenderArena and its associated RenderObjects. In that case, we bail-out and clear m_widgetUpdateSet set.

      BUG=226696

Review URL: https://codereview.chromium.org/14329005

git-svn-id: svn://svn.chromium.org/blink/trunk@148933 bbb929c8-8fbe-4397-9dbb-9b2b20218538
    
commit 905b0461e247bd3f404d2bc437e43a82841823e0
-1
-20
-26
+8 -10
+6 -16
+1 -1
expand_less