Speculative CHECK to pinpoint crash.

The issue below correlates to element_under_pointer_.at returning a
nullptr. All calls to element_under_pointer_.at but one are prefaced
with an if(element_under_pointer_.Contains(...)) check.
That one call is prefaced with a DCHECK. Most likely culprit is that
there is a real-world case in which the DCHECK doesn't hold and is
not covered by our tests.
Making the DCHECK a CHECK should confirm that. We'd still get the
same number of crashes overall, but with a different stacktrace.

Bug: 1114579
Change-Id: Ie28c971ed2114cf4a780f9eb5366c60d7669315c
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2359081Reviewed-by: Kentaro Hara <haraken@chromium.org>
Commit-Queue: Omer Katz <omerkatz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#798657}

third_party/blink/renderer/core/input/pointer_event_manager.cc

@@ -256,8 +256,7 @@ void PointerEventManager::SetElementUnderPointer(PointerEvent* pointer_event,
         element_under_pointer_.at(pointer_event->pointerId());
     if (!target) {
       element_under_pointer_.erase(pointer_event->pointerId());
-    } else if (target !=
-               element_under_pointer_.at(pointer_event->pointerId())->target) {
+    } else if (target != node->target) {
       element_under_pointer_.Set(
           pointer_event->pointerId(),
           MakeGarbageCollected<EventTargetAttributes>(target));
@@ -305,7 +304,7 @@ void PointerEventManager::HandlePointerInterruption(
   for (auto pointer_event : canceled_pointer_events) {
     // If we are sending a pointercancel we have sent the pointerevent to some
     // target before.
-    DCHECK(element_under_pointer_.Contains(pointer_event->pointerId()));
+    CHECK(element_under_pointer_.Contains(pointer_event->pointerId()));
     Element* target =
         element_under_pointer_.at(pointer_event->pointerId())->target;