base::Bind: Cleanup in automation.

chrome/browser/automation/automation_provider_gtk.cc

Index: chrome/browser/automation/automation_provider_gtk.cc
diff --git a/chrome/browser/automation/automation_provider_gtk.cc b/chrome/browser/automation/automation_provider_gtk.cc
index 11b6d31539439a82c61744ce0acfb84a91ef0692..8fd039e2c4aa559972cf88e5b478e31fd2eb0562 100644
--- a/chrome/browser/automation/automation_provider_gtk.cc
+++ b/chrome/browser/automation/automation_provider_gtk.cc
@@ -6,6 +6,7 @@
 
 #include <gtk/gtk.h>
 
+#include "base/callback.h"
 #include "base/utf_string_conversions.h"
 #include "chrome/browser/automation/automation_browser_tracker.h"
 #include "chrome/browser/automation/automation_window_tracker.h"
@@ -22,11 +23,11 @@ void AutomationProvider::PrintAsync(int tab_handle) {
   NOTIMPLEMENTED();
 }
 
-// This task sends a WindowDragResponse message with the appropriate
-// routing ID to the automation proxy.  This is implemented as a task so that
-// we know that the mouse events (and any tasks that they spawn on the message
-// loop) have been processed by the time this is sent.
-class WindowDragResponseTask : public Task {
+// This closure sends a WindowDragResponse message with the appropriate routing
+// ID to the automation proxy.  This is implemented as a task so that we know
+// that the mouse events (and any tasks that they spawn on the message loop)
+// have been processed by the time this is sent.
+class WindowDragResponseTask : public base::Closure {
  public:
   WindowDragResponseTask(AutomationProvider* provider,
                          IPC::Message* reply_message)
@@ -51,10 +52,12 @@ class WindowDragResponseTask : public Task {
   DISALLOW_COPY_AND_ASSIGN(WindowDragResponseTask);
 };
 
-// A task that just runs a SendMouseEvent and performs another task when done.
-class MouseEventTask : public Task {
+// A closure that just runs a SendMouseEvent and performs another task when
+// done.
+class MouseEventTask : public base::Closure {
  public:
-  MouseEventTask(Task* next_task, ui_controls::MouseButtonState state)
+  MouseEventTask(const base::Closure& next_task,
+                 ui_controls::MouseButtonState state)
       : next_task_(next_task),
         state_(state) {}
 
@@ -68,7 +71,7 @@ class MouseEventTask : public Task {
 
  private:
   // The task to execute when we are done.
-  Task* next_task_;
+  base::Closure next_task_;
 
   // Mouse press or mouse release.
   ui_controls::MouseButtonState state_;
@@ -76,10 +79,10 @@ class MouseEventTask : public Task {
   DISALLOW_COPY_AND_ASSIGN(MouseEventTask);
 };
 
-// A task that just runs a SendMouseMove and performs another task when done.
-class MouseMoveTask : public Task {
+// A closure that just runs a SendMouseMove and performs another task when done.
+class MouseMoveTask : public base::Closure {
  public:
-  MouseMoveTask(Task* next_task, int absolute_x, int absolute_y)
+  MouseMoveTask(const base::Closure& next_task, int absolute_x, int absolute_y)
       : next_task_(next_task),
         x_(absolute_x),
         y_(absolute_y) {
@@ -94,7 +97,7 @@ class MouseMoveTask : public Task {
 
  private:
   // The task to execute when we are done.
-  Task* next_task_;
+  base::Closure next_task_;
 
   // Coordinates of the press.
   int x_;
@@ -117,9 +120,10 @@ void AutomationProvider::WindowSimulateDrag(
     gdk_window_get_position(GTK_WIDGET(window)->window, &x, &y);
 
     // Create a nested stack of tasks to run.
-    Task* next_task = new WindowDragResponseTask(this, reply_message);
-    next_task = new MouseEventTask(next_task, ui_controls::UP);
-    next_task = new MouseEventTask(next_task, ui_controls::UP);
+    WindowDragResponseTask task1(this, reply_message);
+    MouseEventTask task2(task1, ui_controls::UP);
+    MouseEventTask task3(task2, ui_controls::UP);
+    base::Closure* task = &task3;
     for (size_t i = drag_path.size() - 1; i > 0; --i) {
       // Smooth out the mouse movements by adding intermediate points. This
       // better simulates a real user drag.
@@ -128,14 +132,15 @@ void AutomationProvider::WindowSimulateDrag(
       int half_step_x = (dest_x + drag_path[i - 1].x() + x) / 2;
       int half_step_y = (dest_y + drag_path[i - 1].y() + y) / 2;
 
-      next_task = new MouseMoveTask(next_task, dest_x, dest_y);
-      next_task = new MouseMoveTask(next_task, half_step_x, half_step_y);
+      MouseMoveTask task4(*task, dest_x, dest_y);
+      MouseMoveTask task5(task4, half_step_x, half_step_y);
+      task = &task5;

[csilv, 2011/10/10 18:36:47]

This looks problematic.  'task' will point to task5 which will be passed into
task6 on line 139.  However, task5 will go out of scope and leave task pointing
to a disposed object.

     }
-    next_task = new MouseEventTask(next_task, ui_controls::DOWN);
+    MouseEventTask task6(*task, ui_controls::DOWN);
 
     ui_controls::SendMouseMoveNotifyWhenDone(x + drag_path[0].x(),
                                              y + drag_path[0].y(),
-                                             next_task);
+                                             task6);
   } else {
     AutomationMsg_WindowDrag::WriteReplyParams(reply_message, false);
     Send(reply_message);