Add a null check for token creation to avoid crash

third_party/WebKit/Source/core/input/PointerEventManager.cpp

Index: third_party/WebKit/Source/core/input/PointerEventManager.cpp
diff --git a/third_party/WebKit/Source/core/input/PointerEventManager.cpp b/third_party/WebKit/Source/core/input/PointerEventManager.cpp
index aa42f46837b4e09bc0c4b25bce46f0f942d3b23f..b6456f68eca99aa70c707c0fe03917f2545f508f 100644
--- a/third_party/WebKit/Source/core/input/PointerEventManager.cpp
+++ b/third_party/WebKit/Source/core/input/PointerEventManager.cpp
@@ -318,7 +318,7 @@ WebInputEventResult PointerEventManager::handleTouchEvents(
   // associated with so just pick the first finger.
   RefPtr<UserGestureToken> possibleGestureToken;
   if (event.type() == PlatformEvent::TouchEnd &&
-      !m_inCanceledStateForPointerTypeTouch) {
+      !m_inCanceledStateForPointerTypeTouch && touchInfos[0].targetFrame) {

[dtapuska, 2016/11/09 21:12:14]

I'd feel safer if we added !touchInfo.isEmpty() as well as I wonder if this can
crash if I throw an WebTouchEvent with no touch points at the renderer.

[Navid Zolghadr, 2016/11/09 21:18:04]

Although that would be weird to pass such a thing and I'm not sure if the rest
of the code is safe to that but sure I added the check here. I actually had it
in the first place and then removed it to make the change minimal to solve the
crash.

     possibleGestureToken =
         DocumentUserGestureToken::create(touchInfos[0].targetFrame->document());
   }