Using the per-revision bisect providing the bisect results,
Good build: 59.0.3071.30 (Revision: 464641 )
Bad build: 60.0.3072.0 (Revision: 464836 )

You are probably looking for a change made after 464697 (known good), but no later than 464698 (first known bad).

CHANGELOG URL:
https://chromium.googlesource.com/chromium/src/+log/188c1056bbfb9c98eca691c12f5641d4204f6066..0f65d25a4097959d977dbb1077717323438240a6

@hugoh: Could you please look into the issue, pardon me if it has nothing to do with your changes and if possible please assign it to concern owner.

Review URL: https://codereview.chromium.org/2616623002


Able to reproduce this issue Using latest Canary #60.0.3087.0 on Win 10 and Mac 10.12.4

Thank You.

These steps hits a DCHECK. That gives some hint about what is broken...

[1:1:0502/130517.561916:FATAL:SelectionTemplate.cpp(112)] Check failed: base_.GetDocument()->DomTreeVersion() == dom_tree_version_ (24172 vs. 24147)Selection(Dirty: 24147 != 24172 base: DIV id="inner-editor" (editable)@offsetInAnchor[0], extent: DIV id="inner-editor" (editable)@offsetInAnchor[0])
#0 0x7fba8c8c2b0b base::debug::StackTrace::StackTrace()
#1 0x7fba8c8c180c base::debug::StackTrace::StackTrace()
#2 0x7fba8c934d03 logging::LogMessage::~LogMessage()
#3 0x7fba7b429771 blink::SelectionTemplate<>::AssertValid()
#4 0x7fba7b42a045 blink::SelectionTemplate<>::Base()
#5 0x7fba7b3ea23b blink::Editor::AppliedEditing()
#6 0x7fba7b47510b blink::CompositeEditCommand::Apply()
#7 0x7fba7b3e835c blink::Editor::DeleteSelectionWithSmartDelete()
#8 0x7fba7b3e8dd5 blink::Editor::DeleteSelectionAfterDraggingWithEvents()
#9 0x7fba7be7ce2a blink::DragController::ConcludeEditDrag()
#10 0x7fba7be7c3bf blink::DragController::PerformDrag()
#11 0x7fba78fcd3d5 blink::WebFrameWidgetBase::DragTargetDrop()
#12 0x7fba87250c58 content::RenderWidget::OnDragTargetDrop()
#13 0x7fba87264758 _ZN4base20DispatchToMethodImplIPN7content12RenderWidgetEMS2_FvRKNS1_8DropDataERKN3gfx5PointESA_iERKSt5tupleIJS4_S8_S8_iEEJLm0ELm1ELm2ELm3EEEEvRKT_T0_OT1_NS_13IndexSequenceIJXspT2_EEEE
#14 0x7fba87264660 _ZN4base16DispatchToMethodIPN7content12RenderWidgetEMS2_FvRKNS1_8DropDataERKN3gfx5PointESA_iERKSt5tupleIJS4_S8_S8_iEEEEvRKT_T0_OT1_
#15 0x7fba872645df _ZN3IPC16DispatchToMethodIN7content12RenderWidgetEMS2_FvRKNS1_8DropDataERKN3gfx5PointES9_iEvSt5tupleIJS3_S7_S7_iEEEEvPT_T0_PT1_RKT2_
#16 0x7fba8725d950 _ZN3IPC8MessageTI23DragMsg_TargetDrop_MetaSt5tupleIJN7content8DropDataEN3gfx5PointES6_iEEvE8DispatchINS3_12RenderWidgetESA_vMSA_FvRKS4_RKS6_SE_iEEEbPKNS_7MessageEPT_PT0_PT1_T2_
#17 0x7fba8724f83f content::RenderWidget::OnMessageReceived()
#18 0x7fba87231b2e content::RenderViewImpl::OnMessageReceived()
#19 0x7fba8ad9dceb IPC::MessageRouter::RouteMessage()
#20 0x7fba8510cfb8 content::ChildThreadImpl::ChildThreadMessageRouter::RouteMessage()
#21 0x7fba8ad9dc6e IPC::MessageRouter::OnMessageReceived()
#22 0x7fba85110d87 content::ChildThreadImpl::OnMessageReceived()
#23 0x7fba8ad48528 IPC::ChannelProxy::Context::OnDispatchMessage()
#24 0x7fba8ad4e33f _ZN4base8internal13FunctorTraitsIMN3IPC12ChannelProxy7ContextEFvRKNS2_7MessageEEvE6InvokeIRK13scoped_refptrIS4_EJS7_EEEvS9_OT_DpOT0_
#25 0x7fba8ad4e226 _ZN4base8internal12InvokeHelperILb0EvE8MakeItSoIRKMN3IPC12ChannelProxy7ContextEFvRKNS4_7MessageEEJRK13scoped_refptrIS6_ES9_EEEvOT_DpOT0_
#26 0x7fba8ad4e1b3 _ZN4base8internal7InvokerINS0_9BindStateIMN3IPC12ChannelProxy7ContextEFvRKNS3_7MessageEEJ13scoped_refptrIS5_ES6_EEEFvvEE7RunImplIRKSA_RKSt5tupleIJSC_S6_EEJLm0ELm1EEEEvOT_OT0_NS_13IndexSequenceIJXspT1_EEEE
#27 0x7fba8ad4e0cc _ZN4base8internal7InvokerINS0_9BindStateIMN3IPC12ChannelProxy7ContextEFvRKNS3_7MessageEEJ13scoped_refptrIS5_ES6_EEEFvvEE3RunEPNS0_13BindStateBaseE
#28 0x7fba8c87e30e _ZNO4base8CallbackIFvvELNS_8internal8CopyModeE0ELNS2_10RepeatModeE0EE3RunEv
#29 0x7fba8c8c875e base::debug::TaskAnnotator::RunTask()
#30 0x7fba7997576e blink::scheduler::TaskQueueManager::ProcessTaskFromWorkQueue()
#31 0x7fba799726f6 blink::scheduler::TaskQueueManager::DoWork()
#32 0x7fba7997dab4 _ZN4base8internal13FunctorTraitsIMN5blink9scheduler16TaskQueueManagerEFvbEvE6InvokeIRKNS_7WeakPtrIS4_EEJRKbEEEvS6_OT_DpOT0_
#33 0x7fba7997d9bf _ZN4base8internal12InvokeHelperILb1EvE8MakeItSoIRKMN5blink9scheduler16TaskQueueManagerEFvbERKNS_7WeakPtrIS6_EEJRKbEEEvOT_OT0_DpOT1_
#34 0x7fba7997d933 _ZN4base8internal7InvokerINS0_9BindStateIMN5blink9scheduler16TaskQueueManagerEFvbEJNS_7WeakPtrIS5_EEbEEEFvvEE7RunImplIRKS7_RKSt5tupleIJS9_bEEJLm0ELm1EEEEvOT_OT0_NS_13IndexSequenceIJXspT1_EEEE
#35 0x7fba7997d84c _ZN4base8internal7InvokerINS0_9BindStateIMN5blink9scheduler16TaskQueueManagerEFvbEJNS_7WeakPtrIS5_EEbEEEFvvEE3RunEPNS0_13BindStateBaseE
#36 0x7fba8c87e30e _ZNO4base8CallbackIFvvELNS_8internal8CopyModeE0ELNS2_10RepeatModeE0EE3RunEv
#37 0x7fba8c8c875e base::debug::TaskAnnotator::RunTask()
#38 0x7fba8c95af5d base::MessageLoop::RunTask()
#39 0x7fba8c95b1e4 base::MessageLoop::DeferOrRunPendingTask()
#40 0x7fba8c95b4d4 base::MessageLoop::DoWork()
#41 0x7fba8c972cc8 base::MessagePumpDefault::Run()
#42 0x7fba8c95aaf7 base::MessageLoop::RunHandler()
#43 0x7fba8ca0650a base::RunLoop::Run()
#44 0x7fba872842ed content::RendererMain()
#45 0x7fba876cce9d content::RunZygote()
#46 0x7fba876cd250 content::RunNamedProcessTypeMain()
#47 0x7fba876cf52d content::ContentMainRunnerImpl::Run()
#48 0x7fba876cbd1a content::ContentServiceManagerMainDelegate::RunEmbedderProcess()
#49 0x7fba8cd63eae service_manager::Main()
#50 0x7fba876ccc4f content::ContentMain()
#51 0x7fba8dc0e09a ChromeMain
#52 0x7fba8dc0dfc2 main
#53 0x7fba75694f45 __libc_start_main
#54 0x7fba8dc0dea4 <unknown>

#3 does give some hint: When dragging the question mark, DragController::DragIsMove() returns true, and then the drag is executed as move instead of copy

The reason is that DragIsMove() only checks the frame selection, which can be different from the element being dragged (the question mark in this case)

Playground: https://jsfiddle.net/L45j3dem/1/

Try selecting everything in the editable div, and then drag the link to the target input -- content in the editable div got delete! This even repros in M58 Stable

Not sure if this is the only cause, though, as the playground doesn't repro exactly this issue

I haven't found out why #3 hits the DCHECK, either...

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/5fb678a9ee8b5e8e303ea0d66ae5efe979e6fcd2

commit 5fb678a9ee8b5e8e303ea0d66ae5efe979e6fcd2
Author: xiaochengh <xiaochengh@chromium.org>
Date: Fri May 12 09:03:01 2017

Make DragController::DragIsMove return false when selection does not have focus

This patch makes the above change so that when dragging with an unfocused
selection, the selection is not considered as the dragging source.

BUG= 717453 
TEST=editing/selection/drag_with_unfocused_selection.html

Review-Url: https://codereview.chromium.org/2877623005
Cr-Commit-Position: refs/heads/master@{#471253}

[add] https://crrev.com/5fb678a9ee8b5e8e303ea0d66ae5efe979e6fcd2/third_party/WebKit/LayoutTests/editing/selection/drag_with_unfocused_selection.html
[modify] https://crrev.com/5fb678a9ee8b5e8e303ea0d66ae5efe979e6fcd2/third_party/WebKit/Source/core/page/DragController.cpp

Just to update, repro steps from C#0 works fine on the latest canary(60.0.3100.0) on Windows-10, Mac OS 10.12.4 and Linux Ubuntu 14.04. Hence adding the verified label.