Merge 121388

Source/WebCore/page/Frame.cpp

 /*
  * Copyright (C) 1998, 1999 Torben Weis <weis@kde.org>
  *                     1999 Lars Knoll <knoll@kde.org>
  *                     1999 Antti Koivisto <koivisto@kde.org>
  *                     2000 Simon Hausmann <hausmann@kde.org>
  *                     2000 Stefan Schimanski <1Stein@gmx.de>
  *                     2001 George Staikos <staikos@kde.org>
  * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009, 2010, 2011 Apple Inc. All rights reserved.
  * Copyright (C) 2005 Alexey Proskuryakov <ap@nypop.com>
  * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
@@ skipping 1031 matching lines @@
     for (const Frame* frame = this; frame; frame = frame->tree()->traverseNext()) {
         if (frame->document())
             count += frame->document()->touchEventHandlerCount();
     }
 
     m_page->chrome()->client()->numTouchEventHandlersChanged(count);
 }
 
 #if !PLATFORM(MAC) && !PLATFORM(WIN)
 struct ScopedFramePaintingState {
-    ScopedFramePaintingState(Frame* theFrame, RenderObject* theRenderer)
-        : frame(theFrame)
-        , renderer(theRenderer)
+    ScopedFramePaintingState(Frame* frame, Node* node)
+        : frame(frame)
+        , node(node)
         , paintBehavior(frame->view()->paintBehavior())
         , backgroundColor(frame->view()->baseBackgroundColor())
     {
+        ASSERT(!node || node->renderer());
+        if (node)
+            node->renderer()->updateDragState(true);
     }
 
     ~ScopedFramePaintingState()
     {
-        if (renderer)
-            renderer->updateDragState(false);
+        if (node && node->renderer())
+            node->renderer()->updateDragState(false);
         frame->view()->setPaintBehavior(paintBehavior);
         frame->view()->setBaseBackgroundColor(backgroundColor);
         frame->view()->setNodeToDraw(0);
     }
 
     Frame* frame;
-    RenderObject* renderer;
+    Node* node;
     PaintBehavior paintBehavior;
     Color backgroundColor;
 };
 
 DragImageRef Frame::nodeImage(Node* node)
 {
-    RenderObject* renderer = node->renderer();
-    if (!renderer)
+    if (!node->renderer())
         return 0;
 
-    const ScopedFramePaintingState state(this, renderer);
+    const ScopedFramePaintingState state(this, node);
 
-    renderer->updateDragState(true);
     m_view->setPaintBehavior(state.paintBehavior | PaintBehaviorFlattenCompositingLayers);
 
     // When generating the drag image for an element, ignore the document background.
     m_view->setBaseBackgroundColor(colorWithOverrideAlpha(Color::white, 1.0));
     m_doc->updateLayout();
     m_view->setNodeToDraw(node); // Enable special sub-tree drawing mode.
 
+    // Document::updateLayout may have blown away the original RenderObject.
+    RenderObject* renderer = node->renderer();
+    if (!renderer)
+      return 0;
+
     LayoutRect topLevelRect;
     IntRect paintingRect = pixelSnappedIntRect(renderer->paintingRootRect(topLevelRect));
 
     OwnPtr<ImageBuffer> buffer(ImageBuffer::create(paintingRect.size(), 1, ColorSpaceDeviceRGB));
     if (!buffer)
         return 0;
     buffer->context()->translate(-paintingRect.x(), -paintingRect.y());
     buffer->context()->clip(FloatRect(0, 0, paintingRect.maxX(), paintingRect.maxY()));
 
     m_view->paintContents(buffer->context(), paintingRect);
@@ skipping 21 matching lines @@
 
     m_view->paintContents(buffer->context(), paintingRect);
 
     RefPtr<Image> image = buffer->copyImage();
     return createDragImageFromImage(image.get());
 }
 
 #endif
 
 } // namespace WebCore