speculative fix of null-deference on CancelDragDrop

The bug report looks like WindowTree calls CancelDragLoop with
nullptr. This means GetWindowByTransportId returns nullptr --
I guess the window is gone during the drag&drop loop.

Other methods in WindowTree (e.g. PerformDragDrop and
PerformWindowMove) check this validity, so this CL adds the same
validation on CancelDragDrop.

Bug: 934260
Test: none
Change-Id: I99fcc370b95ed49deee3ff031ed262ff6b52a655
Reviewed-on: https://chromium-review.googlesource.com/c/1481857
Commit-Queue: Jun Mukai <mukai@chromium.org>
Reviewed-by: Michael Wasserman <msw@chromium.org>
Cr-Commit-Position: refs/heads/master@{#634451}

services/ws/window_tree.cc

@@ -2163,9 +2163,19 @@ void WindowTree::CancelDragDrop(Id window_id) {
   // Clear |pending_drag_source_window_id_| to cancel posted drag loop task.
   pending_drag_source_window_id_ = kInvalidTransportId;
 
+  aura::Window* window = GetWindowByTransportId(window_id);
+  if (!window) {
+    DVLOG(1) << "CancelDragDrop failed (no window)";
+    return;
+  }
+
+  if (!IsClientCreatedWindow(window)) {
+    DVLOG(1) << "CancelDragDrop failed (access denied)";
+    return;
+  }
+
   // Cancel the current drag loop if it is running.
-  window_service_->delegate()->CancelDragLoop(
-      GetWindowByTransportId(window_id));
+  window_service_->delegate()->CancelDragLoop(window);
 }
 
 void WindowTree::ObserveTopmostWindow(mojom::MoveLoopSource source,