Fix crash in mouse event handling with a dirty layout tree.

third_party/WebKit/Source/core/input/MouseEventManager.cpp

Index: third_party/WebKit/Source/core/input/MouseEventManager.cpp
diff --git a/third_party/WebKit/Source/core/input/MouseEventManager.cpp b/third_party/WebKit/Source/core/input/MouseEventManager.cpp
index 5961dd0ce4de863dcfabd41b0a977cb0ac2355ce..ecc4f41902054cac6f5cb3b2a63620f0981d6283 100644
--- a/third_party/WebKit/Source/core/input/MouseEventManager.cpp
+++ b/third_party/WebKit/Source/core/input/MouseEventManager.cpp
@@ -730,7 +730,11 @@ WebInputEventResult MouseEventManager::handleMouseDraggedEvent(
       event, m_mouseDownPos, m_dragStartPos, m_mousePressNode.get(),
       m_lastKnownMousePosition);
 
-  if (m_mouseDownMayStartAutoscroll &&
+  // The call into handleMouseDraggedEvent may have caused a re-layout,
+  // so get the new LayoutObject again.
+  // layoutObject = targetNode->layoutObject();
+
+  if (layoutObject && m_mouseDownMayStartAutoscroll &&
       !m_scrollManager->middleClickAutoscrollInProgress() &&
       !m_frame->selection().selectedHTMLForClipboard().isEmpty()) {
     if (AutoscrollController* controller =