Fix crash in mouse event handling with a dirty layout tree.

third_party/WebKit/Source/core/input/MouseEventManager.cpp

Index: third_party/WebKit/Source/core/input/MouseEventManager.cpp
diff --git a/third_party/WebKit/Source/core/input/MouseEventManager.cpp b/third_party/WebKit/Source/core/input/MouseEventManager.cpp
index 5961dd0ce4de863dcfabd41b0a977cb0ac2355ce..1505b30f9e4d766c9cae86c17f4705820dc30281 100644
--- a/third_party/WebKit/Source/core/input/MouseEventManager.cpp
+++ b/third_party/WebKit/Source/core/input/MouseEventManager.cpp
@@ -730,7 +730,11 @@ WebInputEventResult MouseEventManager::handleMouseDraggedEvent(
       event, m_mouseDownPos, m_dragStartPos, m_mousePressNode.get(),
       m_lastKnownMousePosition);
 
-  if (m_mouseDownMayStartAutoscroll &&
+  // The call into handleMouseDraggedEvent may have caused a re-layout,
+  // so get the new LayoutObject again.

[wkorman, 2017/01/18 23:49:56]

rm 'new', since it's new this time, but wasn't last time. Well, it might be new
this time. Maybe just rephrase to "so get the LayoutObject again in case it's
new."

[chrishtr, 2017/01/19 19:48:35]

Done.

+  layoutObject = targetNode->layoutObject();
+
+  if (layoutObject && m_mouseDownMayStartAutoscroll &&
       !m_scrollManager->middleClickAutoscrollInProgress() &&
       !m_frame->selection().selectedHTMLForClipboard().isEmpty()) {
     if (AutoscrollController* controller =