Fix the crash that could occur when the window is closed while web contents drag is in progress.

content/browser/web_contents/web_contents_view_win.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/web_contents/web_contents_view_win.h"
 
 #include "base/bind.h"
 #include "base/memory/scoped_vector.h"
 #include "content/browser/renderer_host/render_view_host_factory.h"
 #include "content/browser/renderer_host/render_view_host_impl.h"
@@ skipping 81 matching lines @@
   }
 }
 
 }  // namespace namespace
 
 WebContentsViewWin::WebContentsViewWin(WebContentsImpl* web_contents,
                                        WebContentsViewDelegate* delegate)
     : web_contents_(web_contents),
       view_(NULL),
       delegate_(delegate),
-      close_tab_after_drag_ends_(false),
       hwnd_message_filter_(new PositionChangedMessageFilter) {
 }
 
 WebContentsViewWin::~WebContentsViewWin() {
   RemoveHwndToWcvMapEntry(this);
 
   if (IsWindow(hwnd()))
     DestroyWindow(hwnd());
 }
 
@@ skipping 113 matching lines @@
 void WebContentsViewWin::StoreFocus() {
   if (delegate_.get())
     delegate_->StoreFocus();
 }
 
 void WebContentsViewWin::RestoreFocus() {
   if (delegate_.get())
     delegate_->RestoreFocus();
 }
 
-bool WebContentsViewWin::IsDoingDrag() const {
-  return drag_handler_.get() != NULL;
-}
-
-void WebContentsViewWin::CancelDragAndCloseTab() {
-  DCHECK(IsDoingDrag());
-  // We can't close the tab while we're in the drag and
-  // |drag_handler_->CancelDrag()| is async.  Instead, set a flag to cancel
-  // the drag and when the drag nested message loop ends, close the tab.
-  drag_handler_->CancelDrag();
-  close_tab_after_drag_ends_ = true;
-}
-
 WebDropData* WebContentsViewWin::GetDropData() const {
   return drag_dest_->current_drop_data();
 }
 
 bool WebContentsViewWin::IsEventTracking() const {
   return false;
 }
 
 void WebContentsViewWin::CloseTabAfterEventTracking() {
 }
@@ skipping 46 matching lines @@
 void WebContentsViewWin::TakeFocus(bool reverse) {
   if (web_contents_->GetDelegate() &&
       !web_contents_->GetDelegate()->TakeFocus(web_contents_, reverse) &&
       delegate_.get()) {
     delegate_->TakeFocus(reverse);
   }
 }
 
 void WebContentsViewWin::EndDragging() {
   drag_handler_ = NULL;
-  if (close_tab_after_drag_ends_) {
-    close_tab_timer_.Start(FROM_HERE, base::TimeDelta::FromMilliseconds(0),
-                           this, &WebContentsViewWin::CloseTab);
-  }
   web_contents_->SystemDragEnded();
 }
 
 void WebContentsViewWin::CloseTab() {
   RenderViewHost* rvh = web_contents_->GetRenderViewHost();
   rvh->GetDelegate()->Close(rvh);
 }
 
 LRESULT WebContentsViewWin::OnCreate(
     UINT message, WPARAM wparam, LPARAM lparam, BOOL& handled) {
   hwnd_to_wcv_map.insert(std::make_pair(hwnd(), this));
   AddFilterToParentHwndSubclass(hwnd(), hwnd_message_filter_.get());
   return 0;
 }
 
 LRESULT WebContentsViewWin::OnDestroy(
     UINT message, WPARAM wparam, LPARAM lparam, BOOL& handled) {
   if (drag_dest_.get()) {
     RevokeDragDrop(GetNativeView());
     drag_dest_ = NULL;
   }
+  if (drag_handler_.get()) {
+    drag_handler_->CancelDrag();
+    drag_handler_ = NULL;
+  }
   return 0;
 }
 
 LRESULT WebContentsViewWin::OnWindowPosChanged(
     UINT message, WPARAM wparam, LPARAM lparam, BOOL& handled) {
 
   // Our parent might have changed. So we re-install our hwnd message filter.
   AddFilterToParentHwndSubclass(hwnd(), hwnd_message_filter_.get());
 
   WINDOWPOS* window_pos = reinterpret_cast<WINDOWPOS*>(lparam);
@@ skipping 138 matching lines @@
   si.nMin = 1;
   si.nMax = 100;
   si.nPage = 10;
   si.nPos = 50;
 
   ::SetScrollInfo(hwnd(), SB_HORZ, &si, FALSE);
   ::SetScrollInfo(hwnd(), SB_VERT, &si, FALSE);
 
   return 1;
 }