DragController: Clear DragState on Document shutdown.

Otherwise, DataTransfer retains the last document that used a JS
wrapper through
  Page->DragController->DragState->DataTransfer->...

Bug: 928781,843903
Change-Id: I92219fb9a325a8a9d0ceb7050512b22f6942c85f
Reviewed-on: https://chromium-review.googlesource.com/c/1479991Reviewed-by: Kentaro Hara <haraken@chromium.org>
Reviewed-by: Yuki Shiino <yukishiino@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#634673}

third_party/blink/renderer/core/page/drag_controller.cc

@@ -141,7 +141,8 @@ static DataTransfer* CreateDraggingDataTransfer(DataTransferAccessPolicy policy,
 }
 
 DragController::DragController(Page* page)
-    : page_(page),
+    : ContextLifecycleObserver(nullptr),
+      page_(page),
       document_under_mouse_(nullptr),
       drag_initiator_(nullptr),
       file_input_element_under_mouse_(nullptr),
@@ -1302,6 +1303,7 @@ void DragController::DoSystemDrag(DragImage* image,
                                   bool for_link) {
   did_initiate_drag_ = true;
   drag_initiator_ = frame->GetDocument();
+  SetContext(drag_initiator_);
 
   // TODO(pdr): |drag_location| and |event_pos| should be passed in as
   // FloatPoints and we should calculate these adjusted values in floating
@@ -1358,12 +1360,17 @@ DragState& DragController::GetDragState() {
   return *drag_state_;
 }
 
+void DragController::ContextDestroyed(ExecutionContext*) {
+  drag_state_ = nullptr;
+}
+
 void DragController::Trace(blink::Visitor* visitor) {
   visitor->Trace(page_);
   visitor->Trace(document_under_mouse_);
   visitor->Trace(drag_initiator_);
   visitor->Trace(drag_state_);
   visitor->Trace(file_input_element_under_mouse_);
+  ContextLifecycleObserver::Trace(visitor);
 }
 
 }  // namespace blink

third_party/blink/renderer/core/page/drag_controller.h

@@ -29,6 +29,7 @@
 #include "base/macros.h"
 #include "third_party/blink/renderer/core/core_export.h"
 #include "third_party/blink/renderer/core/dom/events/event_target.h"
+#include "third_party/blink/renderer/core/execution_context/context_lifecycle_observer.h"
 #include "third_party/blink/renderer/core/page/drag_actions.h"
 #include "third_party/blink/renderer/platform/geometry/int_point.h"
 #include "third_party/blink/renderer/platform/heap/handle.h"
@@ -51,7 +52,10 @@ class Page;
 class WebMouseEvent;
 
 class CORE_EXPORT DragController final
-    : public GarbageCollected<DragController> {
+    : public GarbageCollected<DragController>,
+      public ContextLifecycleObserver {
+  USING_GARBAGE_COLLECTED_MIXIN(DragController);
+
  public:
   static DragController* Create(Page*);
 
@@ -89,7 +93,10 @@ class CORE_EXPORT DragController final
   // to the visual viewport.
   static FloatRect ClippedSelection(const LocalFrame&);
 
-  void Trace(blink::Visitor*);
+  // ContextLifecycleObserver.
+  void ContextDestroyed(ExecutionContext*) final;
+
+  void Trace(blink::Visitor*) final;
 
  private:
   DispatchEventResult DispatchTextInputEventFor(LocalFrame*, DragData*);