Fix Crash in DragDropClientMac::Drop()

ui/views/cocoa/drag_drop_client_mac.mm

 // Copyright 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #import "ui/views/cocoa/drag_drop_client_mac.h"
 
 #include "base/mac/mac_util.h"
 #include "base/run_loop.h"
 #include "base/strings/sys_string_conversions.h"
 #import "ui/base/dragdrop/os_exchange_data_provider_mac.h"
@@ skipping 130 matching lines @@
         [sender draggingSourceOperationMask]);
   }
 
   drag_operation = drop_helper_.OnDragOver(
       *[data_source_ data], LocationInView([sender draggingLocation]),
       operation_);
   return ui::DragDropTypes::DragOperationToNSDragOperation(drag_operation);
 }
 
 NSDragOperation DragDropClientMac::Drop(id<NSDraggingInfo> sender) {
-  int drag_operation = drop_helper_.OnDrop(
-      *[data_source_ data], LocationInView([sender draggingLocation]),
-      operation_);
+  // OnDrop can optionally delete |this|, so clear data members first.
+  base::scoped_nsobject<CocoaDragDropDataProvider> data_source = data_source_;
+  int operation = operation_;
   data_source_.reset();
   operation_ = 0;
+
+  int drag_operation = drop_helper_.OnDrop(
+      *[data_source data], LocationInView([sender draggingLocation]),
+      operation);
   return ui::DragDropTypes::DragOperationToNSDragOperation(drag_operation);
 }
 
 void DragDropClientMac::EndDrag() {
   data_source_.reset();
 
   // Allow a test to invoke EndDrag() without spinning the nested run loop.
   if (!quit_closure_.is_null()) {
     quit_closure_.Run();
     quit_closure_.Reset();
   }
 }
 
 gfx::Point DragDropClientMac::LocationInView(NSPoint point) const {
   return gfx::Point(point.x, NSHeight([bridge_->ns_window() frame]) - point.y);
 }
 
 }  // namespace views