Fix the crash that could occur when the window is closed while web contents drag is in progress.

content/browser/web_contents/web_contents_view_aura.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/web_contents/web_contents_view_aura.h"
 
 #include "base/utf_string_conversions.h"
 #include "content/browser/renderer_host/dip_util.h"
 #include "content/browser/renderer_host/render_view_host_factory.h"
 #include "content/browser/web_contents/interstitial_page_impl.h"
 #include "content/browser/web_contents/web_contents_impl.h"
+#include "content/public/browser/notification_observer.h"
+#include "content/public/browser/notification_registrar.h"
+#include "content/public/browser/notification_source.h"
+#include "content/public/browser/notification_types.h"
 #include "content/public/browser/render_view_host.h"
 #include "content/public/browser/render_widget_host.h"
 #include "content/public/browser/render_widget_host_view.h"
 #include "content/public/browser/web_contents_delegate.h"
 #include "content/public/browser/web_contents_view_delegate.h"
 #include "content/public/browser/web_drag_dest_delegate.h"
 #include "third_party/WebKit/Source/WebKit/chromium/public/WebInputEvent.h"
 #include "ui/aura/client/aura_constants.h"
 #include "ui/aura/client/drag_drop_client.h"
 #include "ui/aura/client/drag_drop_delegate.h"
@@ skipping 17 matching lines @@
   WebContentsViewAura* rv = new WebContentsViewAura(web_contents, delegate);
   *render_view_host_delegate_view = rv;
   return rv;
 }
 }
 
 namespace {
 
 // Listens to all mouse drag events during a drag and drop and sends them to
 // the renderer.
-class WebDragSourceAura : public MessageLoopForUI::Observer {
+class WebDragSourceAura : public MessageLoopForUI::Observer,
+                          public content::NotificationObserver {
  public:
-  explicit WebDragSourceAura(WebContentsImpl* contents)
-      : contents_(contents) {
+  WebDragSourceAura(aura::Window* window, WebContentsImpl* contents)
+      : window_(window),
+        contents_(contents) {
     MessageLoopForUI::current()->AddObserver(this);
+    registrar_.Add(this, content::NOTIFICATION_WEB_CONTENTS_DISCONNECTED,
+                   content::Source<content::WebContents>(contents));
   }
 
   virtual ~WebDragSourceAura() {
     MessageLoopForUI::current()->RemoveObserver(this);
   }
 
   // MessageLoop::Observer implementation:
   virtual base::EventStatus WillProcessEvent(
       const base::NativeEvent& event) OVERRIDE {
     return base::EVENT_CONTINUE;
   }
   virtual void DidProcessEvent(const base::NativeEvent& event) OVERRIDE {
+    if (!contents_)
+      return;
     ui::EventType type = ui::EventTypeFromNative(event);
     content::RenderViewHost* rvh = NULL;
     switch (type) {
       case ui::ET_MOUSE_DRAGGED:
         rvh = contents_->GetRenderViewHost();
         if (rvh) {
           gfx::Point screen_loc_in_pixel = ui::EventLocationFromNative(event);
           gfx::Point screen_loc = content::ConvertPointToDIP(rvh->GetView(),
               screen_loc_in_pixel);
           gfx::Point client_loc = screen_loc;
           aura::Window* window = rvh->GetView()->GetNativeView();
           aura::Window::ConvertPointToTarget(window->GetRootWindow(),
               window, &client_loc);
           rvh->DragSourceMovedTo(client_loc.x(), client_loc.y(),
               screen_loc.x(), screen_loc.y());
         }
         break;
       default:
         break;
     }
   }
 
+  virtual void Observe(int type,
+      const content::NotificationSource& source,
+      const content::NotificationDetails& details) OVERRIDE {
+    if (content::NOTIFICATION_WEB_CONTENTS_DISCONNECTED != type)
+      return;
+
+    // Cancel the drag if it is still in progress.
+    aura::client::DragDropClient* dnd_client =
+        aura::client::GetDragDropClient(window_->GetRootWindow());
+    if (dnd_client && dnd_client->IsDragDropInProgress())
+      dnd_client->DragCancel();
+
+    window_ = NULL;
+    contents_ = NULL;
+  }
+
+  aura::Window* window() const { return window_; }
 
  private:
+  aura::Window* window_;
   WebContentsImpl* contents_;
+  content::NotificationRegistrar registrar_;
 
   DISALLOW_COPY_AND_ASSIGN(WebDragSourceAura);
 };
 
 // Utility to fill a ui::OSExchangeDataProviderAura object from WebDropData.
 void PrepareDragData(const WebDropData& drop_data,
                      ui::OSExchangeDataProviderAura* provider) {
   if (!drop_data.text.string().empty())
     provider->SetString(drop_data.text.string());
   if (drop_data.url.is_valid())
@@ skipping 105 matching lines @@
 ////////////////////////////////////////////////////////////////////////////////
 // WebContentsViewAura, public:
 
 WebContentsViewAura::WebContentsViewAura(
     WebContentsImpl* web_contents,
     content::WebContentsViewDelegate* delegate)
     : web_contents_(web_contents),
       view_(NULL),
       delegate_(delegate),
       current_drag_op_(WebKit::WebDragOperationNone),
-      close_tab_after_drag_ends_(false),
       drag_dest_delegate_(NULL),
       current_rvh_for_drag_(NULL) {
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // WebContentsViewAura, private:
 
 WebContentsViewAura::~WebContentsViewAura() {
   // Window needs a valid delegate during its destructor, so we explicitly
   // delete it here.
@@ skipping 134 matching lines @@
 void WebContentsViewAura::StoreFocus() {
   if (delegate_.get())
     delegate_->StoreFocus();
 }
 
 void WebContentsViewAura::RestoreFocus() {
   if (delegate_.get())
     delegate_->RestoreFocus();
 }
 
-bool WebContentsViewAura::IsDoingDrag() const {
-  aura::RootWindow* root_window = GetNativeView()->GetRootWindow();
-  if (aura::client::GetDragDropClient(root_window))
-    return aura::client::GetDragDropClient(root_window)->IsDragDropInProgress();
-  return false;
-}
-
-void WebContentsViewAura::CancelDragAndCloseTab() {
-  DCHECK(IsDoingDrag());
-  // We can't close the tab while we're in the drag and
-  // |drag_handler_->CancelDrag()| is async.  Instead, set a flag to cancel
-  // the drag and when the drag nested message loop ends, close the tab.
-  aura::RootWindow* root_window = GetNativeView()->GetRootWindow();
-  if (aura::client::GetDragDropClient(root_window))
-    aura::client::GetDragDropClient(root_window)->DragCancel();
-
-  close_tab_after_drag_ends_ = true;
-}
-
 WebDropData* WebContentsViewAura::GetDropData() const {
   return NULL;
 }
 
 bool WebContentsViewAura::IsEventTracking() const {
   return false;
 }
 
 void WebContentsViewAura::CloseTabAfterEventTracking() {
 }
@@ skipping 34 matching lines @@
 
   ui::OSExchangeDataProviderAura* provider = new ui::OSExchangeDataProviderAura;
   PrepareDragData(drop_data, provider);
   if (!image.isNull()) {
     provider->set_drag_image(image);
     provider->set_drag_image_offset(image_offset);
   }
   ui::OSExchangeData data(provider);  // takes ownership of |provider|.
 
   scoped_ptr<WebDragSourceAura> drag_source(
-      new WebDragSourceAura(web_contents_));
+      new WebDragSourceAura(GetNativeView(), web_contents_));
 
   // We need to enable recursive tasks on the message loop so we can get
   // updates while in the system DoDragDrop loop.
   int result_op = 0;
   {
     // TODO(sad): Avoid using GetCursorScreenPoint here, since the drag may not
     // always start from a mouse-event (e.g. a touch or gesture event could
     // initiate the drag). The location information should be carried over from
     // webkit. http://crbug.com/114754
     gfx::Point location(gfx::Screen::GetCursorScreenPoint());
     MessageLoop::ScopedNestableTaskAllower allow(MessageLoop::current());
     result_op = aura::client::GetDragDropClient(root_window)->StartDragAndDrop(
         data, root_window, location, ConvertFromWeb(operations));
   }
 
+  // Bail out immediately if the contents view window is gone. Note that it is
+  // not safe to access any class members after system drag-and-drop returns
+  // since the class instance might be gone. The local variable |drag_source|
+  // is still valid and we can check its window property that is set to NULL
+  // when the contents are gone.
+  if (!drag_source->window())
+    return;
+
   EndDrag(ConvertToWeb(result_op));
   web_contents_->GetRenderViewHost()->DragSourceSystemDragEnded();
 }
 
 void WebContentsViewAura::UpdateDragCursor(WebKit::WebDragOperation operation) {
   current_drag_op_ = operation;
 }
 
 void WebContentsViewAura::GotFocus() {
   if (web_contents_->GetDelegate())
@@ skipping 186 matching lines @@
     OnDragEntered(event);
 
   web_contents_->GetRenderViewHost()->DragTargetDrop(
       event.location(),
       gfx::Screen::GetCursorScreenPoint(),
       ConvertAuraEventFlagsToWebInputEventModifiers(event.flags()));
   if (drag_dest_delegate_)
     drag_dest_delegate_->OnDrop();
   return current_drag_op_;
 }