Speculative fix for crash in blink::DragData::modifiers.

third_party/WebKit/Source/web/WebFrameWidgetBase.cpp

 // Copyright 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "web/WebFrameWidgetBase.h"
 
 #include "core/dom/DocumentUserGestureToken.h"
 #include "core/frame/FrameView.h"
 #include "core/frame/VisualViewport.h"
 #include "core/input/EventHandler.h"
@@ skipping 62 matching lines @@
   operations_allowed_ = operations_allowed;
 
   return DragTargetDragEnterOrOver(point_in_viewport, screen_point, kDragOver,
                                    modifiers);
 }
 
 void WebFrameWidgetBase::DragTargetDragLeave(const WebPoint& point_in_viewport,
                                              const WebPoint& screen_point) {
   DCHECK(current_drag_data_);
 
-  if (IgnoreInputEvents()) {
+  // TODO(paulmeyer): It shouldn't be possible for |m_currentDragData| to be
+  // null here, but this is somehow happening (rarely). This suggests that in
+  // some cases drag-leave is happening before drag-enter, which should be
+  // impossible. This needs to be investigated further. Once fixed, the extra
+  // check for |!m_currentDragData| should be removed. (crbug.com/671152)
+  if (IgnoreInputEvents() || !current_drag_data_) {
     CancelDrag();
     return;
   }
 
   WebPoint point_in_root_frame(ViewportToRootFrame(point_in_viewport));
   DragData drag_data(current_drag_data_.Get(), point_in_root_frame,
                      screen_point,
                      static_cast<DragOperation>(operations_allowed_));
 
   GetPage()->GetDragController().DragExited(&drag_data,
@@ skipping 181 matching lines @@
 
   if (GetPage()) {
     WebMouseEvent transformed_event = TransformWebMouseEvent(
         ToWebLocalFrameImpl(LocalRoot())->GetFrameView(), mouse_event);
     GetPage()->GetPointerLockController().DispatchLockedMouseEvent(
         transformed_event, event_type);
   }
 }
 
 }  // namespace blink