From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
From: Mason Freed <masonfreed@chromium.org>
Date: Mon, 20 Jul 2020 19:55:49 +0000
Subject: Reland "Fix UAF in SelectType"

This is a reland of 72158deaf3751325f1983c87829f65441ee32de3

The only change made here is to add the new test to LeakExpectations,
pointing to crbug.com/1103082. Local testing shows that this leak
is triggered by the new test, both before and after this patch. And
since the patch fixes a UAF security bug, I'd like to land it with the
test, and then work on the leak.

Fixed: 1102408
Bug: 1103082

TBR=masonfreed@chromium.org

Original change's description:
> Fix UAF in SelectType
>
> This fixes the UAF detected by ClusterFuzz in [1], caused by [2].
> The test case added here is a minimized version of the clusterfuzz
> case, and I verified that it crashes (ASAN UAF) before this patch
> and no longer crashes after.
>
> [1] https://clusterfuzz.com/testcase-detail/6224868955193344
> [2] https://chromium-review.googlesource.com/c/chromium/src/+/1912682
>
> Fixed: 1102408
> Change-Id: Ieb6a9582ff5b9676596048920bbcff881fdc2eb2
> Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2283901
> Commit-Queue: Mason Freed <masonfreed@chromium.org>
> Auto-Submit: Mason Freed <masonfreed@chromium.org>
> Reviewed-by: Kent Tamura <tkent@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#785970}

(cherry picked from commit e1c45006a8e5a97778eeed0010a7f57d86e70ca4)

Change-Id: I471cb4abc98a7627803de4e434e0453cb729c15f
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2288372
Auto-Submit: Mason Freed <masonfreed@chromium.org>
Reviewed-by: Kent Tamura <tkent@chromium.org>
Commit-Queue: Mason Freed <masonfreed@chromium.org>
Cr-Original-Commit-Position: refs/heads/master@{#786562}
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2307621
Reviewed-by: Mason Freed <masonfreed@chromium.org>
Cr-Commit-Position: refs/branch-heads/4147@{#902}
Cr-Branched-From: 16307825352720ae04d898f37efa5449ad68b606-refs/heads/master@{#768962}

diff --git a/third_party/blink/renderer/core/html/forms/select_type.cc b/third_party/blink/renderer/core/html/forms/select_type.cc
index 345cbeb26823c5f111f2bc2b98fc15f99efe3314..b5a7e169964b40a51b073ae13b2922019bee0927 100644
--- a/third_party/blink/renderer/core/html/forms/select_type.cc
+++ b/third_party/blink/renderer/core/html/forms/select_type.cc
@@ -709,7 +709,7 @@ bool ListBoxSelectType::DefaultEventHandler(const Event& event) {
 
       if (Page* page = select_->GetDocument().GetPage()) {
         page->GetAutoscrollController().StartAutoscrollForSelection(
-            layout_object);
+            select_->GetLayoutObject());
       }
     }
     // Mousedown didn't happen in this element.
diff --git a/third_party/blink/web_tests/fast/forms/select/select-change-layout-object-crash-expected.txt b/third_party/blink/web_tests/fast/forms/select/select-change-layout-object-crash-expected.txt
new file mode 100644
index 0000000000000000000000000000000000000000..cbe81f73ef4a3684565b70d51fe460b22702964f
--- /dev/null
+++ b/third_party/blink/web_tests/fast/forms/select/select-change-layout-object-crash-expected.txt
@@ -0,0 +1 @@
+PASS - this test passes if it does not crash (ASAN)
diff --git a/third_party/blink/web_tests/fast/forms/select/select-change-layout-object-crash.html b/third_party/blink/web_tests/fast/forms/select/select-change-layout-object-crash.html
new file mode 100644
index 0000000000000000000000000000000000000000..8e9361dd7cd1f954a2c482aab7c182789ddc0701
--- /dev/null
+++ b/third_party/blink/web_tests/fast/forms/select/select-change-layout-object-crash.html
@@ -0,0 +1,17 @@
+<style>
+.c:hover { display: block; }
+</style>
+
+<select id=target autofocus=autofocus size=2 class=c></select>
+
+<script>
+if (window.testRunner)
+	testRunner.dumpAsText();
+
+window.onload = function() {
+    eventSender.beginDragWithFiles( ["resources/file-for-drag-to-navigate.html"]);
+    eventSender.mouseMoveTo(target.offsetLeft + 5, target.offsetTop + 5);
+};
+</script>
+
+<p>PASS - this test passes if it does not crash (ASAN)</p>
