Fix crash in mouse event handling with a dirty layout tree.

third_party/WebKit/Source/core/input/MouseEventManager.cpp

 // Copyright 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "core/input/MouseEventManager.h"
 
 #include "core/clipboard/DataObject.h"
 #include "core/clipboard/DataTransfer.h"
 #include "core/dom/Element.h"
 #include "core/dom/ElementTraversal.h"
@@ skipping 712 matching lines @@
     if (!layoutObject || !layoutObject->isListBox())
       return WebInputEventResult::NotHandled;
   }
 
   m_mouseDownMayStartDrag = false;
 
   m_frame->eventHandler().selectionController().handleMouseDraggedEvent(
       event, m_mouseDownPos, m_dragStartPos, m_mousePressNode.get(),
       m_lastKnownMousePosition);
 
-  if (m_mouseDownMayStartAutoscroll &&
+  // The call into handleMouseDraggedEvent may have caused a re-layout,
+  // so get the LayoutObject again.
+  layoutObject = targetNode->layoutObject();
+
+  if (layoutObject && m_mouseDownMayStartAutoscroll &&
       !m_scrollManager->middleClickAutoscrollInProgress() &&
       !m_frame->selection().selectedHTMLForClipboard().isEmpty()) {
     if (AutoscrollController* controller =
             m_scrollManager->autoscrollController()) {
       controller->startAutoscrollForSelection(layoutObject);
       m_mouseDownMayStartAutoscroll = false;
     }
   }
 
   return WebInputEventResult::HandledSystem;
@@ skipping 244 matching lines @@
 
 void MouseEventManager::setClickCount(int clickCount) {
   m_clickCount = clickCount;
 }
 
 bool MouseEventManager::mouseDownMayStartDrag() {
   return m_mouseDownMayStartDrag;
 }
 
 }  // namespace blink