Don't send touch events to windows like menus when the touch occurs outside the menu bounds.

ui/views/controls/menu/menu_controller.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "ui/views/controls/menu/menu_controller.h"
 
 #include "base/i18n/case_conversion.h"
 #include "base/i18n/rtl.h"
 #include "base/macros.h"
 #include "base/strings/utf_string_conversions.h"
@@ skipping 21 matching lines @@
 #include "ui/views/focus/view_storage.h"
 #include "ui/views/mouse_constants.h"
 #include "ui/views/view.h"
 #include "ui/views/view_constants.h"
 #include "ui/views/views_delegate.h"
 #include "ui/views/widget/root_view.h"
 #include "ui/views/widget/tooltip_manager.h"
 #include "ui/views/widget/widget.h"
 
 #if defined(OS_WIN)
+#include "ui/aura/window_tree_host.h"
 #include "ui/base/win/internal_constants.h"
 #include "ui/gfx/win/dpi.h"
 #include "ui/views/win/hwnd_util.h"
 #endif
 
 using base::Time;
 using base::TimeDelta;
 using ui::OSExchangeData;
 
 // Period of the scroll timer (in milliseconds).
@@ skipping 414 matching lines @@
         current_mouse_event_target_ = forward_to_root;
       }
 
       // ...and we always return the result of the current handler.
       if (current_mouse_event_target_)
         return processed;
     }
   }
 
   // Otherwise, the menu handles this click directly.
-  SetSelectionOnPointerDown(source, event);
+  SetSelectionOnPointerDown(source, &event);
   return true;
 }
 
 bool MenuController::OnMouseDragged(SubmenuView* source,
                                     const ui::MouseEvent& event) {
   if (current_mouse_event_target_) {
     ui::MouseEvent event_for_root(event);
     ConvertLocatedEventForRootView(source, current_mouse_event_target_,
                                    &event_for_root);
     return current_mouse_event_target_->ProcessMouseDragged(event_for_root);
@@ skipping 141 matching lines @@
 bool MenuController::OnMouseWheel(SubmenuView* source,
                                   const ui::MouseWheelEvent& event) {
   MenuPart part = GetMenuPart(source, event.location());
   return part.submenu && part.submenu->OnMouseWheel(event);
 }
 
 void MenuController::OnGestureEvent(SubmenuView* source,
                                     ui::GestureEvent* event) {
   MenuPart part = GetMenuPart(source, event->location());
   if (event->type() == ui::ET_GESTURE_TAP_DOWN) {
-    SetSelectionOnPointerDown(source, *event);
+    SetSelectionOnPointerDown(source, event);
     event->StopPropagation();
   } else if (event->type() == ui::ET_GESTURE_LONG_PRESS) {
     if (part.type == MenuPart::MENU_ITEM && part.menu) {
       gfx::Point screen_location(event->location());
       View::ConvertPointToScreen(source->GetScrollViewContainer(),
                                  &screen_location);
       if (ShowContextMenu(part.menu, screen_location, ui::MENU_SOURCE_TOUCH))
         event->StopPropagation();
     }
   } else if (event->type() == ui::ET_GESTURE_TAP) {
@@ skipping 23 matching lines @@
   }
 
   if (event->stopped_propagation())
       return;
 
   if (!part.submenu)
     return;
   part.submenu->OnGestureEvent(event);
 }
 
+void MenuController::OnTouchEvent(SubmenuView* source, ui::TouchEvent* event) {

[jonross, 2016/01/14 23:25:02]

This change prevents CrOS from being able to close Menu Widgets on touch events
that are out of bounds.

The lack of canceling like in SetSelectionOnPointerDown prevents this.

I have an upcoming patch that addresses a crash in RepostEvent. I'll provide a
fix to this there.

+  if (event->type() == ui::ET_TOUCH_PRESSED) {
+    MenuPart part = GetMenuPart(source, event->location());
+    if (part.type == MenuPart::NONE) {
+      RepostEvent(source, event);
+      event->SetHandled();
+    }
+  }
+}
+
 View* MenuController::GetTooltipHandlerForPoint(SubmenuView* source,
                                                 const gfx::Point& point) {
   MenuHostRootView* root_view = GetRootView(source, point);
   return root_view ? root_view->ProcessGetTooltipHandlerForPoint(point)
                    : nullptr;
 }
 
 void MenuController::ViewHierarchyChanged(
     SubmenuView* source,
     const View::ViewHierarchyChangedDetails& details) {
@@ skipping 271 matching lines @@
   // Notify an accessibility focus event on all menu items except for the root.
   if (menu_item &&
       (MenuDepth(menu_item) != 1 ||
        menu_item->GetType() != MenuItemView::SUBMENU)) {
     menu_item->NotifyAccessibilityEvent(
         ui::AX_EVENT_FOCUS, true);
   }
 }
 
 void MenuController::SetSelectionOnPointerDown(SubmenuView* source,
-                                               const ui::LocatedEvent& event) {
+                                               const ui::LocatedEvent* event) {
   if (!blocking_run_)
     return;
 
   DCHECK(!GetActiveMouseView());
 
-  MenuPart part = GetMenuPart(source, event.location());
+  MenuPart part = GetMenuPart(source, event->location());
   if (part.is_scroll())
     return;  // Ignore presses on scroll buttons.
 
   // When this menu is opened through a touch event, a simulated right-click
   // is sent before the menu appears.  Ignore it.
-  if ((event.flags() & ui::EF_RIGHT_MOUSE_BUTTON) &&
-      (event.flags() & ui::EF_FROM_TOUCH))
+  if ((event->flags() & ui::EF_RIGHT_MOUSE_BUTTON) &&
+      (event->flags() & ui::EF_FROM_TOUCH))
     return;
 
   if (part.type == MenuPart::NONE ||
       (part.type == MenuPart::MENU_ITEM && part.menu &&
        part.menu->GetRootMenuItem() != state_.item->GetRootMenuItem())) {
     // Remember the time stamp of the current (press down) event. The owner can
     // then use this to figure out if this menu was finished with the same click
     // which is sent to it thereafter.
-    closing_event_time_ = event.time_stamp();
+    closing_event_time_ = event->time_stamp();
 
     // Mouse wasn't pressed over any menu, or the active menu, cancel.
 
 #if defined(OS_WIN)
     // We're going to close and we own the mouse capture. We need to repost the
     // mouse down, otherwise the window the user clicked on won't get the event.
     RepostEvent(source, event);
 #endif
 
     // And close.
     ExitType exit_type = EXIT_ALL;
     if (!menu_stack_.empty()) {
       // We're running nested menus. Only exit all if the mouse wasn't over one
       // of the menus from the last run.
-      gfx::Point screen_loc(event.location());
+      gfx::Point screen_loc(event->location());
       View::ConvertPointToScreen(source->GetScrollViewContainer(), &screen_loc);
       MenuPart last_part = GetMenuPartByScreenCoordinateUsingMenu(
           menu_stack_.back().first.item, screen_loc);
       if (last_part.type != MenuPart::NONE)
         exit_type = EXIT_OUTERMOST;
     }
     Cancel(exit_type);
 
 #if defined(OS_CHROMEOS)
     // We're going to exit the menu and want to repost the event so that is
     // is handled normally after the context menu has exited. We call
     // RepostEvent after Cancel so that mouse capture has been released so
     // that finding the event target is unaffected by the current capture.
     RepostEvent(source, event);
 #endif
     // Do not repost events for Linux Aura because this behavior is more
     // consistent with the behavior of other Linux apps.
     return;
   }
 
   // On a press we immediately commit the selection, that way a submenu
   // pops up immediately rather than after a delay.
   int selection_types = SELECTION_UPDATE_IMMEDIATELY;
   if (!part.menu) {
     part.menu = part.parent;
     selection_types |= SELECTION_OPEN_SUBMENU;
   } else {
     if (part.menu->GetDelegate()->CanDrag(part.menu)) {
       possible_drag_ = true;
-      press_pt_ = event.location();
+      press_pt_ = event->location();
     }
     if (part.menu->HasSubmenu())
       selection_types |= SELECTION_OPEN_SUBMENU;
   }
   SetSelection(part.menu, selection_types);
 }
 
 void MenuController::StartDrag(SubmenuView* source,
                                const gfx::Point& location) {
   MenuItemView* item = state_.item;
@@ skipping 1124 matching lines @@
     item->GetSubmenu()->GetPrefixSelector()->InsertText(char_array);
   } else {
     // If no mnemonics found, look at first character of titles.
     details = FindChildForMnemonic(item, key, &TitleMatchesMnemonic);
     if (details.first_match != -1)
       AcceptOrSelect(item, details);
   }
 }
 
 void MenuController::RepostEvent(SubmenuView* source,
-                                 const ui::LocatedEvent& event) {
-  if (!event.IsMouseEvent()) {
+                                 const ui::LocatedEvent* event) {
+  if (!event->IsMouseEvent() && !event->IsTouchEvent()) {
     // TODO(rbyers): Gesture event repost is tricky to get right
     // crbug.com/170987.
-    DCHECK(event.IsGestureEvent());
+    DCHECK(event->IsGestureEvent());
     return;
   }
 
 #if defined(OS_WIN)
   if (!state_.item) {
     // We some times get an event after closing all the menus. Ignore it. Make
     // sure the menu is in fact not visible. If the menu is visible, then
     // we're in a bad state where we think the menu isn't visibile but it is.
     DCHECK(!source->GetWidget()->IsVisible());
     return;
   }
 
   state_.item->GetRootMenuItem()->GetSubmenu()->ReleaseCapture();
 #endif
 
-  gfx::Point screen_loc(event.location());
+  gfx::Point screen_loc(event->location());
   View::ConvertPointToScreen(source->GetScrollViewContainer(), &screen_loc);
   gfx::NativeView native_view = source->GetWidget()->GetNativeView();
   if (!native_view)
     return;
 
   gfx::Screen* screen = gfx::Screen::GetScreenFor(native_view);
   gfx::NativeWindow window = screen->GetWindowAtScreenPoint(screen_loc);
 
 #if defined(OS_WIN)
+  gfx::Point screen_loc_pixels = gfx::win::DIPToScreenPoint(screen_loc);
+  HWND target_window = ::WindowFromPoint(screen_loc_pixels.ToPOINT());
+  // If we don't find a native window for the HWND at the current location,
+  // then attempt to find a native window from its parent if one exists.
+  // There are HWNDs created outside views, which don't have associated
+  // native windows.
+  if (!window) {
+    HWND parent = ::GetParent(target_window);
+    if (parent) {
+      aura::WindowTreeHost* host =
+          aura::WindowTreeHost::GetForAcceleratedWidget(parent);
+      if (host) {
+        target_window = parent;
+        window = host->window();
+      }
+    }
+  }
   // Convert screen_loc to pixels for the Win32 API's like WindowFromPoint,
   // PostMessage/SendMessage to work correctly. These API's expect the
   // coordinates to be in pixels.
-  // PostMessage() to metro windows isn't allowed (access will be denied). Don't
-  // try to repost with Win32 if the window under the mouse press is in metro.
-  if (!ViewsDelegate::GetInstance() ||
-      !ViewsDelegate::GetInstance()->IsWindowInMetro(window)) {
-    gfx::Point screen_loc_pixels = gfx::win::DIPToScreenPoint(screen_loc);
-    HWND target_window = window ? HWNDForNativeWindow(window) :
-                                  WindowFromPoint(screen_loc_pixels.ToPOINT());
+  if (event->IsMouseEvent()) {
     HWND source_window = HWNDForNativeView(native_view);
     if (!target_window || !source_window ||
         GetWindowThreadProcessId(source_window, NULL) !=
         GetWindowThreadProcessId(target_window, NULL)) {
       // Even though we have mouse capture, windows generates a mouse event if
       // the other window is in a separate thread. Only repost an event if
       // |target_window| and |source_window| were created on the same thread,
       // else double events can occur and lead to bad behavior.
       return;
     }
 
     // Determine whether the click was in the client area or not.
     // NOTE: WM_NCHITTEST coordinates are relative to the screen.
     LPARAM coords = MAKELPARAM(screen_loc_pixels.x(), screen_loc_pixels.y());
     LRESULT nc_hit_result = SendMessage(target_window, WM_NCHITTEST, 0, coords);
     const bool client_area = nc_hit_result == HTCLIENT;
 
     // TODO(sky): this isn't right. The event to generate should correspond with
     // the event we just got. MouseEvent only tells us what is down, which may
     // differ. Need to add ability to get changed button from MouseEvent.
     int event_type;
-    int flags = event.flags();
+    int flags = event->flags();
     if (flags & ui::EF_LEFT_MOUSE_BUTTON) {
       event_type = client_area ? WM_LBUTTONDOWN : WM_NCLBUTTONDOWN;
     } else if (flags & ui::EF_MIDDLE_MOUSE_BUTTON) {
       event_type = client_area ? WM_MBUTTONDOWN : WM_NCMBUTTONDOWN;
     } else if (flags & ui::EF_RIGHT_MOUSE_BUTTON) {
       event_type = client_area ? WM_RBUTTONDOWN : WM_NCRBUTTONDOWN;
     } else {
       NOTREACHED();
       return;
     }
 
     int window_x = screen_loc_pixels.x();
     int window_y = screen_loc_pixels.y();
     if (client_area) {
       POINT pt = { window_x, window_y };
       ScreenToClient(target_window, &pt);
       window_x = pt.x;
       window_y = pt.y;
     }
 
-    WPARAM target = client_area ? event.native_event().wParam : nc_hit_result;
+    WPARAM target = client_area ? event->native_event().wParam : nc_hit_result;
     LPARAM window_coords = MAKELPARAM(window_x, window_y);
     PostMessage(target_window, event_type, target, window_coords);
     return;
   }
 #endif
-  // Non-Windows Aura or |window| is in metro mode.
+  // Non Aura window.
   if (!window)
     return;
 
   MenuMessageLoop::RepostEventToWindow(event, window, screen_loc);
 }
 
 void MenuController::SetDropMenuItem(
     MenuItemView* new_target,
     MenuDelegate::DropPosition new_position) {
   if (new_target == drop_target_ && new_position == drop_position_)
@@ skipping 244 matching lines @@
   }
 }
 
 gfx::Screen* MenuController::GetScreen() {
   Widget* root = owner_ ? owner_->GetTopLevelWidget() : NULL;
   return root ? gfx::Screen::GetScreenFor(root->GetNativeView())
               : gfx::Screen::GetNativeScreen();
 }
 
 }  // namespace views