Reset DragState::m_dragSrc when mouse move doesn't meet drag threshold.

third_party/WebKit/Source/core/input/EventHandlerTest.cpp

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "core/input/EventHandler.h"
 
 #include "core/dom/Document.h"
 #include "core/dom/Range.h"
 #include "core/editing/Editor.h"
 #include "core/editing/FrameSelection.h"
@@ skipping 238 matching lines @@
           .build());
   PlatformMouseEvent mouseDownEvent(
       IntPoint(0, 0), IntPoint(100, 200), WebPointerProperties::Button::Right,
       PlatformEvent::MousePressed, 1, PlatformEvent::Modifiers::RightButtonDown,
       TimeTicks::Now());
   EXPECT_EQ(
       WebInputEventResult::HandledApplication,
       document().frame()->eventHandler().sendContextMenuEvent(mouseDownEvent));
 }
 
+TEST_F(EventHandlerTest, dragEndInNewDrag) {
+  setHtmlInnerHTML(
+      "<style>.box { width: 100px; height: 100px; display: block; }</style>"
+      "<a class='box' href=''>Drag me</a>");
+
+  PlatformMouseEvent mouseDownEvent(
+      IntPoint(50, 50), IntPoint(50, 50), WebPointerProperties::Button::Left,
+      PlatformEvent::MousePressed, 1, PlatformEvent::Modifiers::LeftButtonDown,
+      TimeTicks::Now());
+  document().frame()->eventHandler().handleMousePressEvent(mouseDownEvent);
+
+  PlatformMouseEvent mouseMoveEvent(
+      IntPoint(51, 50), IntPoint(51, 50), WebPointerProperties::Button::Left,
+      PlatformEvent::MouseMoved, 1, PlatformEvent::Modifiers::LeftButtonDown,
+      TimeTicks::Now());
+  document().frame()->eventHandler().handleMouseMoveEvent(
+      mouseMoveEvent, Vector<PlatformMouseEvent>());
+
+  // This reproduces what might be the conditions of http://crbug.com/677916
+  // Given the current code, it is unclear how the dragSourceEndedAt() call
+  // could occur before a drag operation is started.

[dcheng, 2017/01/17 22:24:11]

Let's file a followup bug for this (or make sure we track it in the original)
and note that here as a TODO: if we are violating this condition, this is a
pretty big violation of the invariants that the renderer assumes the browser
will keep.

[pwnall, 2017/01/18 00:17:49]

Done.

I'll also monitor the crash metrics to make sure this fix makes the crash go
away.

+
+  PlatformMouseEvent mouseUpEvent(
+      IntPoint(100, 50), IntPoint(200, 250), WebPointerProperties::Button::Left,
+      PlatformEvent::MouseReleased, 1, static_cast<PlatformEvent::Modifiers>(0),
+      TimeTicks::Now());
+  document().frame()->eventHandler().dragSourceEndedAt(mouseUpEvent,
+                                                       DragOperationNone);
+
+  // This test passes if it doesn't crash.
+}
+
 }  // namespace blink