Fix crash in mouse event handling with a dirty layout tree.

third_party/WebKit/Source/core/input/MouseEventManager.cpp

Index: third_party/WebKit/Source/core/input/MouseEventManager.cpp
diff --git a/third_party/WebKit/Source/core/input/MouseEventManager.cpp b/third_party/WebKit/Source/core/input/MouseEventManager.cpp
index 547576bfcfdcb621c8255bb0b1b2028f38caf45c..b385763178ce55bb5bb71ac5a1290c91de0cddd8 100644
--- a/third_party/WebKit/Source/core/input/MouseEventManager.cpp
+++ b/third_party/WebKit/Source/core/input/MouseEventManager.cpp
@@ -730,7 +730,11 @@ WebInputEventResult MouseEventManager::handleMouseDraggedEvent(
       event, m_mouseDownPos, m_dragStartPos, m_mousePressNode.get(),
       m_lastKnownMousePosition);
 
-  if (m_mouseDownMayStartAutoscroll &&
+  // The call into handleMouseDraggedEvent may have caused a re-layout,
+  // so get the LayoutObject again.
+  layoutObject = targetNode->layoutObject();
+
+  if (layoutObject && m_mouseDownMayStartAutoscroll &&
       !m_scrollManager->middleClickAutoscrollInProgress() &&
       !m_frame->selection().selectedHTMLForClipboard().isEmpty()) {
     if (AutoscrollController* controller =