Index: content/browser/renderer_host/render_widget_host_input_event_router.cc |
diff --git a/content/browser/renderer_host/render_widget_host_input_event_router.cc b/content/browser/renderer_host/render_widget_host_input_event_router.cc |
index 888d7ee4c3d191e145f4cd6c160fa9a2ce93f2d2..cb96ee2baaebbe5c11a0de76ae583bf83fb0c90c 100644 |
--- a/content/browser/renderer_host/render_widget_host_input_event_router.cc |
+++ b/content/browser/renderer_host/render_widget_host_input_event_router.cc |
@@ -359,6 +359,10 @@ void RenderWidgetHostInputEventRouter::RouteTouchEvent( |
break; |
case blink::WebInputEvent::TouchEnd: |
case blink::WebInputEvent::TouchCancel: |
+ // It might be safer to test active_touches_ and only decrement it if it's |
+ // non-zero, since active_touches_ can be reset to 0 in |
+ // OnRenderWidgetHostViewBaseDestroyed, and this can happen between the |
+ // TouchStart and a subsequent TouchMove/End/Cancel. |
DCHECK(active_touches_); |
active_touches_ -= CountChangedTouchPoints(*event); |
if (!touch_target_.target) |