Delegate dragend to the correct frame's EventHandler.

third_party/WebKit/Source/core/input/EventHandler.cpp

 /*
  * Copyright (C) 2006, 2007, 2008, 2009, 2010, 2011 Apple Inc. All rights
  * reserved.
  * Copyright (C) 2006 Alexey Proskuryakov (ap@webkit.org)
  * Copyright (C) 2012 Digia Plc. and/or its subsidiary(-ies)
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
@@ skipping 1949 matching lines @@
   return m_keyboardEventManager->keyEvent(initialKeyEvent);
 }
 
 void EventHandler::defaultKeyboardEventHandler(KeyboardEvent* event) {
   m_keyboardEventManager->defaultKeyboardEventHandler(
       event, m_mouseEventManager->mousePressNode());
 }
 
 void EventHandler::dragSourceEndedAt(const PlatformMouseEvent& event,
                                      DragOperation operation) {
-  m_mouseEventManager->dragSourceEndedAt(event, operation);
+  HitTestRequest request(HitTestRequest::ReadOnly);
+  MouseEventWithHitTestResults mev =
+      EventHandlingUtil::performMouseEventHitTest(m_frame, request, event);
+
+  LocalFrame* targetFrame;
+  if (targetIsFrame(mev.innerNode(), targetFrame))
+    targetFrame->eventHandler().dragSourceEndedAt(event, operation);

[dcheng, 2016/11/03 03:09:59]

Specifically, null-checking targetFrame here fixes both failing test locally for
me.

+  else
+    m_mouseEventManager->dragSourceEndedAt(event, operation);
 }
 
 void EventHandler::updateDragStateAfterEditDragIfNeeded(
     Element* rootEditableElement) {
   // If inserting the dragged contents removed the drag source, we still want to
   // fire dragend at the root editble element.
   if (m_mouseEventManager->dragState().m_dragSrc &&
       !m_mouseEventManager->dragState().m_dragSrc->isConnected())
     m_mouseEventManager->dragState().m_dragSrc = rootEditableElement;
 }
@@ skipping 105 matching lines @@
 }
 
 FrameHost* EventHandler::frameHost() const {
   if (!m_frame->page())
     return nullptr;
 
   return &m_frame->page()->frameHost();
 }
 
 }  // namespace blink