Reset DragState::m_dragSrc when mouse move doesn't meet drag threshold.

third_party/WebKit/Source/core/input/EventHandlerTest.cpp

Index: third_party/WebKit/Source/core/input/EventHandlerTest.cpp
diff --git a/third_party/WebKit/Source/core/input/EventHandlerTest.cpp b/third_party/WebKit/Source/core/input/EventHandlerTest.cpp
index dbce543599c4478ae123567a37ebc5bba6745824..1f1bf148ef2d45844822c79656a4fba84feaf7a2 100644
--- a/third_party/WebKit/Source/core/input/EventHandlerTest.cpp
+++ b/third_party/WebKit/Source/core/input/EventHandlerTest.cpp
@@ -256,4 +256,36 @@ TEST_F(EventHandlerTest, sendContextMenuEventWithHover) {
       document().frame()->eventHandler().sendContextMenuEvent(mouseDownEvent));
 }
 
+TEST_F(EventHandlerTest, dragEndInNewDrag) {
+  setHtmlInnerHTML(
+      "<style>.box { width: 100px; height: 100px; display: block; }</style>"
+      "<a class='box' href=''>Drag me</a>");
+
+  PlatformMouseEvent mouseDownEvent(
+      IntPoint(50, 50), IntPoint(50, 50), WebPointerProperties::Button::Left,
+      PlatformEvent::MousePressed, 1, PlatformEvent::Modifiers::LeftButtonDown,
+      TimeTicks::Now());
+  document().frame()->eventHandler().handleMousePressEvent(mouseDownEvent);
+
+  PlatformMouseEvent mouseMoveEvent(
+      IntPoint(51, 50), IntPoint(51, 50), WebPointerProperties::Button::Left,
+      PlatformEvent::MouseMoved, 1, PlatformEvent::Modifiers::LeftButtonDown,
+      TimeTicks::Now());
+  document().frame()->eventHandler().handleMouseMoveEvent(
+      mouseMoveEvent, Vector<PlatformMouseEvent>());
+
+  // This reproduces what might be the conditions of http://crbug.com/677916
+  // Given the current code, it is unclear how the dragSourceEndedAt() call
+  // could occur before a drag operation is started.

[dcheng, 2017/01/17 22:24:11]

Let's file a followup bug for this (or make sure we track it in the original)
and note that here as a TODO: if we are violating this condition, this is a
pretty big violation of the invariants that the renderer assumes the browser
will keep.

[pwnall, 2017/01/18 00:17:49]

Done.

I'll also monitor the crash metrics to make sure this fix makes the crash go
away.

+
+  PlatformMouseEvent mouseUpEvent(
+      IntPoint(100, 50), IntPoint(200, 250), WebPointerProperties::Button::Left,
+      PlatformEvent::MouseReleased, 1, static_cast<PlatformEvent::Modifiers>(0),
+      TimeTicks::Now());
+  document().frame()->eventHandler().dragSourceEndedAt(mouseUpEvent,
+                                                       DragOperationNone);
+
+  // This test passes if it doesn't crash.
+}
+
 }  // namespace blink