Add a null check for token creation to avoid crash

third_party/WebKit/Source/core/input/PointerEventManager.cpp

 // Copyright 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "core/input/PointerEventManager.h"
 
 #include "core/dom/DocumentUserGestureToken.h"
 #include "core/dom/ElementTraversal.h"
 #include "core/dom/shadow/FlatTreeTraversal.h"
 #include "core/events/MouseEvent.h"
@@ skipping 300 matching lines @@
   // Any finger lifting is a user gesture only when it wasn't associated with a
   // scroll.
   // https://docs.google.com/document/d/1oF1T3O7_E4t1PYHV6gyCwHxOi3ystm0eSL5xZu7nvOg/edit#
   // Re-use the same UserGesture for touchend and pointerup (but not for the
   // mouse events generated by GestureTap).
   // For the rare case of multi-finger scenarios spanning documents, it
   // seems extremely unlikely to matter which document the gesture is
   // associated with so just pick the first finger.
   RefPtr<UserGestureToken> possibleGestureToken;
   if (event.type() == PlatformEvent::TouchEnd &&
-      !m_inCanceledStateForPointerTypeTouch) {
+      !m_inCanceledStateForPointerTypeTouch && !touchInfos.isEmpty() &&
+      touchInfos[0].targetFrame) {
     possibleGestureToken =
         DocumentUserGestureToken::create(touchInfos[0].targetFrame->document());
   }
   UserGestureIndicator holder(possibleGestureToken);
 
   dispatchTouchPointerEvents(event, touchInfos);
 
   return m_touchEventManager->handleTouchEvent(event, touchInfos);
 }
 
@@ skipping 386 matching lines @@
       return true;
   }
   return false;
 }
 
 EventTarget* PointerEventManager::getMouseCapturingNode() {
   return getCapturingNode(PointerEventFactory::s_mouseId);
 }
 
 }  // namespace blink