Add a null check for token creation to avoid crash

third_party/WebKit/Source/core/input/PointerEventManager.cpp

 // Copyright 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "core/input/PointerEventManager.h"
 
 #include "core/dom/DocumentUserGestureToken.h"
 #include "core/dom/ElementTraversal.h"
 #include "core/dom/shadow/FlatTreeTraversal.h"
 #include "core/events/MouseEvent.h"
@@ skipping 300 matching lines @@
   // Any finger lifting is a user gesture only when it wasn't associated with a
   // scroll.
   // https://docs.google.com/document/d/1oF1T3O7_E4t1PYHV6gyCwHxOi3ystm0eSL5xZu7nvOg/edit#
   // Re-use the same UserGesture for touchend and pointerup (but not for the
   // mouse events generated by GestureTap).
   // For the rare case of multi-finger scenarios spanning documents, it
   // seems extremely unlikely to matter which document the gesture is
   // associated with so just pick the first finger.
   RefPtr<UserGestureToken> possibleGestureToken;
   if (event.type() == PlatformEvent::TouchEnd &&
-      !m_inCanceledStateForPointerTypeTouch) {
+      !m_inCanceledStateForPointerTypeTouch && touchInfos[0].targetFrame) {

[dtapuska, 2016/11/09 21:12:14]

I'd feel safer if we added !touchInfo.isEmpty() as well as I wonder if this can
crash if I throw an WebTouchEvent with no touch points at the renderer.

[Navid Zolghadr, 2016/11/09 21:18:04]

Although that would be weird to pass such a thing and I'm not sure if the rest
of the code is safe to that but sure I added the check here. I actually had it
in the first place and then removed it to make the change minimal to solve the
crash.

     possibleGestureToken =
         DocumentUserGestureToken::create(touchInfos[0].targetFrame->document());
   }
   UserGestureIndicator holder(possibleGestureToken);
 
   dispatchTouchPointerEvents(event, touchInfos);
 
   return m_touchEventManager->handleTouchEvent(event, touchInfos);
 }
 
@@ skipping 386 matching lines @@
       return true;
   }
   return false;
 }
 
 EventTarget* PointerEventManager::getMouseCapturingNode() {
   return getCapturingNode(PointerEventFactory::s_mouseId);
 }
 
 }  // namespace blink