Fix a crash that happens if a tab is closed while

chrome/browser/views/tab_contents/tab_contents_view_win.cc

 // Copyright (c) 2006-2008 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/views/tab_contents/tab_contents_view_win.h"
 
 #include <windows.h>
 
 #include "app/gfx/canvas_paint.h"
 #include "app/os_exchange_data.h"
+#include "base/time.h"
 #include "chrome/browser/bookmarks/bookmark_drag_data.h"
 #include "chrome/browser/browser.h"  // TODO(beng): this dependency is awful.
 #include "chrome/browser/browser_process.h"
 #include "chrome/browser/download/download_request_manager.h"
 #include "chrome/browser/renderer_host/render_process_host.h"
 #include "chrome/browser/renderer_host/render_view_host.h"
 #include "chrome/browser/renderer_host/render_view_host_factory.h"
 #include "chrome/browser/renderer_host/render_widget_host_view_win.h"
 #include "chrome/browser/tab_contents/interstitial_page.h"
 #include "chrome/browser/tab_contents/tab_contents.h"
@@ skipping 26 matching lines @@
 }  // namespace
 
 // static
 TabContentsView* TabContentsView::Create(TabContents* tab_contents) {
   return new TabContentsViewWin(tab_contents);
 }
 
 TabContentsViewWin::TabContentsViewWin(TabContents* tab_contents)
     : TabContentsView(tab_contents),
       ignore_next_char_event_(false),
-      focus_manager_(NULL) {
+      focus_manager_(NULL),
+      close_tab_after_drag_ends_(false) {
   last_focused_view_storage_id_ =
       views::ViewStorage::GetSharedInstance()->CreateStorageID();
 }
 
 TabContentsViewWin::~TabContentsViewWin() {
   // Makes sure to remove any stored view we may still have in the ViewStorage.
   //
   // It is possible the view went away before us, so we only do this if the
   // view is registered.
   views::ViewStorage* view_storage = views::ViewStorage::GetSharedInstance();
   if (view_storage->RetrieveView(last_focused_view_storage_id_) != NULL)
     view_storage->RemoveView(last_focused_view_storage_id_);
+
+  DCHECK(!drag_source_.get());
 }
 
 void TabContentsViewWin::Unparent() {
   // Remember who our FocusManager is, we won't be able to access it once
   // unparented.
   focus_manager_ = views::WidgetWin::GetFocusManager();
   // Note that we do not DCHECK on focus_manager_ as it may be NULL when used
   // with an external tab container.
   ::SetParent(GetNativeView(), NULL);
 }
@@ skipping 87 matching lines @@
       // Pass in NULL as the profile so that the bookmark always adds the url
       // rather than trying to move an existing url.
       bm_drag_data.Write(NULL, data);
     } else {
       data->SetURL(drop_data.url, drop_data.url_title);
     }
   }
   if (!drop_data.plain_text.empty())
     data->SetString(drop_data.plain_text);
 
-  scoped_refptr<WebDragSource> drag_source(
-      new WebDragSource(GetNativeView(), tab_contents()->render_view_host()));
+  drag_source_ = new WebDragSource(GetNativeView(),
+                                   tab_contents()->render_view_host());
 
   DWORD effects;
 
   // We need to enable recursive tasks on the message loop so we can get
   // updates while in the system DoDragDrop loop.
   bool old_state = MessageLoop::current()->NestableTasksAllowed();
   MessageLoop::current()->SetNestableTasksAllowed(true);
-  DoDragDrop(data, drag_source, DROPEFFECT_COPY | DROPEFFECT_LINK, &effects);
+  DoDragDrop(data, drag_source_, DROPEFFECT_COPY | DROPEFFECT_LINK, &effects);
   MessageLoop::current()->SetNestableTasksAllowed(old_state);
 
+  drag_source_ = NULL;
+  if (close_tab_after_drag_ends_) {
+    close_tab_timer_.Start(base::TimeDelta::FromMilliseconds(0), this,
+                           &TabContentsViewWin::CloseTab);
+  }
+
   if (tab_contents()->render_view_host())
     tab_contents()->render_view_host()->DragSourceSystemDragEnded();
 }
 
 void TabContentsViewWin::OnContentsDestroy() {
   // TODO(brettw) this seems like maybe it can be moved into OnDestroy and this
   // function can be deleted? If you're adding more here, consider whether it
   // can be moved into OnDestroy which is a Windows message handler as the
   // window is being torn down.
 
@@ skipping 128 matching lines @@
       // if the location bar was focused and the tab is dragged out), or it may
       // no longer be focusable (e.g. if the location bar was focused and then
       // we switched to fullscreen mode).  In that case we default to the
       // default focus.
       SetInitialFocus();
     }
     view_storage->RemoveView(last_focused_view_storage_id_);
   }
 }
 
+bool TabContentsViewWin::IsDoingDrag() const {
+  return drag_source_.get() != NULL;
+}
+
+void TabContentsViewWin::CancelDragAndCloseTab() {
+  DCHECK(IsDoingDrag());
+  // We can't close the tab while we're in the drag and
+  // |drag_source_->CancelDrag()| is async.  Instead, set a flag to cancel
+  // the drag and when the drag nested message loop ends, close the tab.
+  drag_source_->CancelDrag();
+  close_tab_after_drag_ends_ = true;
+}
+
 void TabContentsViewWin::UpdateDragCursor(bool is_drop_target) {
   drop_target_->set_is_drop_target(is_drop_target);
 }
 
 void TabContentsViewWin::GotFocus() {
   if (tab_contents()->delegate())
     tab_contents()->delegate()->TabContentsFocused(tab_contents());
 }
 
 void TabContentsViewWin::TakeFocus(bool reverse) {
@@ skipping 68 matching lines @@
     return focus_manager;
   }
   // TODO(jcampan): we should DCHECK on focus_manager_, as it should not be
   // NULL.  We are not doing it as it breaks some unit-tests.  We should
   // probably have an empty TabContentView implementation for the unit-tests,
   // that would prevent that code being executed in the unit-test case.
   // DCHECK(focus_manager_);
   return focus_manager_;
 }
 
+void TabContentsViewWin::CloseTab() {
+  tab_contents()->Close(tab_contents()->render_view_host());
+}
+
 void TabContentsViewWin::ShowContextMenu(const ContextMenuParams& params) {
   // Allow delegates to handle the context menu operation first.
   if (tab_contents()->delegate()->HandleContextMenu(params))
     return;
 
   context_menu_.reset(new RenderViewContextMenuWin(tab_contents(), params));
   context_menu_->Init();
 
   POINT screen_pt = { params.x, params.y };
   MapWindowPoints(GetNativeView(), HWND_DESKTOP, &screen_pt, 1);
@@ skipping 203 matching lines @@
   }
   return false;
 }
 
 void TabContentsViewWin::WheelZoom(int distance) {
   if (tab_contents()->delegate()) {
     bool zoom_in = distance > 0;
     tab_contents()->delegate()->ContentsZoomChange(zoom_in);
   }
 }