Fix crash where a RenderWidgetHost can be deleted in the middle of a

content/browser/web_contents/web_contents_view_aura.h

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef CONTENT_BROWSER_WEB_CONTENTS_WEB_CONTENTS_VIEW_AURA_H_
 #define CONTENT_BROWSER_WEB_CONTENTS_WEB_CONTENTS_VIEW_AURA_H_
 
 #include <memory>
 #include <vector>
 
@@ skipping 48 matching lines @@
     init_rwhv_with_null_parent_for_testing_ = set;
   }
 
  private:
   class WindowObserver;
 
   ~WebContentsViewAura() override;
 
   void SizeChangedCommon(const gfx::Size& size);
 
-  void EndDrag(blink::WebDragOperationsMask ops);
+  void EndDrag(RenderWidgetHost* source_rwh, blink::WebDragOperationsMask ops);
 
   void InstallOverscrollControllerDelegate(RenderWidgetHostViewAura* view);
 
   // Sets up the content window in preparation for starting an overscroll
   // gesture.
   void PrepareContentWindowForOverscroll();
 
   // Completes the navigation in response to a completed overscroll gesture.
   // The navigation happens after an animation (either the overlay window
   // animates in, or the content window animates out).
@@ skipping 116 matching lines @@
 
   // We keep track of the RenderWidgetHost we're dragging over. If it changes
   // during a drag, we need to re-send the DragEnter message.
   base::WeakPtr<RenderWidgetHostImpl> current_rwh_for_drag_;
 
   // We also keep track of the RenderViewHost we're dragging over to avoid
   // sending the drag exited message after leaving the current
   // view. |current_rvh_for_drag_| should not be dereferenced.
   void* current_rvh_for_drag_;
 
-  // We keep track of the RenderWidgetHost from which the current drag started,
-  // in order to properly route the drag end message to it.
-  base::WeakPtr<RenderWidgetHostImpl> drag_start_rwh_;
-
   // The overscroll gesture currently in progress.
   OverscrollMode current_overscroll_gesture_;
 
   // This is the completed overscroll gesture. This is used for the animation
   // callback that happens in response to a completed overscroll gesture.
   OverscrollMode completed_overscroll_gesture_;
 
   // This manages the overlay window that shows the screenshot during a history
   // navigation triggered by the overscroll gesture.
   std::unique_ptr<OverscrollNavigationOverlay> navigation_overlay_;
 
   std::unique_ptr<GestureNavSimple> gesture_nav_simple_;
 
   bool init_rwhv_with_null_parent_for_testing_;
 
   DISALLOW_COPY_AND_ASSIGN(WebContentsViewAura);
 };
 
 }  // namespace content
 
 #endif  // CONTENT_BROWSER_WEB_CONTENTS_WEB_CONTENTS_VIEW_AURA_H_