Speculative fix for crash in blink::WebFrameWidgetBase::dragTargetDragEnterOrOver

third_party/WebKit/Source/web/WebFrameWidgetBase.cpp

 // Copyright 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "web/WebFrameWidgetBase.h"
 
 #include "core/frame/FrameHost.h"
 #include "core/frame/VisualViewport.h"
 #include "core/input/EventHandler.h"
 #include "core/page/DragActions.h"
@@ skipping 159 matching lines @@
   m_doingDragAndDrop = true;
   client()->startDragging(policy, data, mask, dragImage, dragImageOffset);
 }
 
 WebDragOperation WebFrameWidgetBase::dragTargetDragEnterOrOver(
     const WebPoint& pointInViewport,
     const WebPoint& screenPoint,
     DragAction dragAction,
     int modifiers) {
   DCHECK(m_currentDragData);
-  if (ignoreInputEvents()) {
+  // TODO(paulmeyer): It shouldn't be possible for |m_currentDragData| to be
+  // null here, but this is somehow happening (rarely). This suggests that in
+  // some cases drag-over is happening before drag-enter, which should be
+  // impossible. This needs to be investigated further. Once fixed, the extra
+  // check for |!m_currentDragData| should be removed. (crbug.com/671504)
+  if (ignoreInputEvents() || !m_currentDragData) {
     cancelDrag();
     return WebDragOperationNone;
   }
 
   WebPoint pointInRootFrame(viewportToRootFrame(pointInViewport));
 
   m_currentDragData->setModifiers(modifiers);
   DragData dragData(m_currentDragData.get(), pointInRootFrame, screenPoint,
                     static_cast<DragOperation>(m_operationsAllowed));
 
@@ skipping 21 matching lines @@
 
 WebViewImpl* WebFrameWidgetBase::view() const {
   return toWebLocalFrameImpl(localRoot())->viewImpl();
 }
 
 Page* WebFrameWidgetBase::page() const {
   return view()->page();
 }
 
 }  // namespace blink