Check if touch target is stale before dispatching.

If a touch target is not in the |owner_map| anymore, it's already been deleted;
fallback to INPUT_EVENT_ACK_STATE_NO_CONSUMER_EXISTS and DumpWithoutCrashing to
help debugging why |host| can be null in ProcessTouchEvent.

Bug: 814674
Change-Id: Ibf3faf1344f43760c4a60155316c193a78a61018
Reviewed-on: https://chromium-review.googlesource.com/1160795
Commit-Queue: Ria Jiang <riajiang@chromium.org>
Reviewed-by: Ken Buchanan <kenrb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#580546}

content/browser/renderer_host/render_widget_host_input_event_router.cc

@@ -596,6 +596,14 @@ void RenderWidgetHostInputEventRouter::DispatchTouchEvent(
   }
   DCHECK_GE(active_touches_, 0);
 
+  // Debugging for crbug.com/814674.
+  if (touch_target_.target && !IsViewInMap(touch_target_.target)) {
+    NOTREACHED() << "Touch events should not be routed to a destroyed target "
+                    "View.";
+    touch_target_.target = nullptr;
+    base::debug::DumpWithoutCrashing();
+  }
+
   if (!touch_target_.target) {
     TouchEventWithLatencyInfo touch_with_latency(touch_event, latency);
     root_view->ProcessAckedTouchEvent(touch_with_latency,