Fix crash in pointer_event_manager.cc

See comments in the issue for explanation of the crash.

Bug: 1114579
Change-Id: Ic8158b53f5de1b0239003202bafb654e6584fad6
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2379757
Commit-Queue: Omer Katz <omerkatz@chromium.org>
Auto-Submit: Omer Katz <omerkatz@chromium.org>
Reviewed-by: Kentaro Hara <haraken@chromium.org>
Cr-Commit-Position: refs/heads/master@{#802280}

third_party/blink/renderer/core/input/pointer_event_manager.cc

@@ -256,8 +256,7 @@ void PointerEventManager::SetElementUnderPointer(PointerEvent* pointer_event,
         element_under_pointer_.at(pointer_event->pointerId());
     if (!target) {
       element_under_pointer_.erase(pointer_event->pointerId());
-    } else if (target !=
-               element_under_pointer_.at(pointer_event->pointerId())->target) {
+    } else if (target != node->target) {
       element_under_pointer_.Set(
           pointer_event->pointerId(),
           MakeGarbageCollected<EventTargetAttributes>(target));
@@ -305,9 +304,10 @@ void PointerEventManager::HandlePointerInterruption(
   for (auto pointer_event : canceled_pointer_events) {
     // If we are sending a pointercancel we have sent the pointerevent to some
     // target before.
-    DCHECK(element_under_pointer_.Contains(pointer_event->pointerId()));
-    Element* target =
-        element_under_pointer_.at(pointer_event->pointerId())->target;
+    Element* target = nullptr;
+    if (element_under_pointer_.Contains(pointer_event->pointerId())) {
+      target = element_under_pointer_.at(pointer_event->pointerId())->target;
+    }
 
     DispatchPointerEvent(
         GetEffectiveTargetForPointerEvent(target, pointer_event->pointerId()),