Fix crash which occurs when a widget destroys itself as a result of ET_GESTURE_TAP_DOWN

ui/views/widget/root_view.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "ui/views/widget/root_view.h"
 
 #include <algorithm>
 
 #include "base/logging.h"
 #include "base/message_loop/message_loop.h"
 #include "ui/base/accessibility/accessible_view_state.h"
 #include "ui/base/dragdrop/drag_drop_types.h"
 #include "ui/compositor/layer.h"
 #include "ui/events/event.h"
 #include "ui/events/keycodes/keyboard_codes.h"
 #include "ui/gfx/canvas.h"
 #include "ui/views/focus/view_storage.h"
 #include "ui/views/layout/fill_layout.h"
 #include "ui/views/views_switches.h"
 #include "ui/views/widget/widget.h"
 #include "ui/views/widget/widget_delegate.h"
-#include "ui/views/widget/widget_deletion_observer.h"
 
 #if defined(USE_AURA)
 #include "ui/base/cursor/cursor.h"
 #endif
 
 namespace views {
 namespace internal {
 
 namespace {
 
@@ skipping 184 matching lines @@
 }
 
 void RootView::DispatchGestureEvent(ui::GestureEvent* event) {
   if (gesture_handler_) {
     // |gesture_handler_| (or |scroll_gesture_handler_|) can be deleted during
     // processing.
     View* handler = scroll_gesture_handler_ &&
         (event->IsScrollGestureEvent() || event->IsFlingScrollEvent())  ?
             scroll_gesture_handler_ : gesture_handler_;
     ui::GestureEvent handler_event(*event, static_cast<View*>(this), handler);
-    DispatchEventToTarget(handler, &handler_event);
+    ui::EventDispatchDetails dispatch_details =
+        DispatchEventToTarget(handler, &handler_event);
+    if (dispatch_details.dispatcher_destroyed)
+      return;
 
     if (event->type() == ui::ET_GESTURE_END &&
         event->details().touch_points() <= 1) {
       // In case a drag was in progress, reset all the handlers. Otherwise, just
       // reset the gesture handler.
       if (gesture_handler_ == mouse_pressed_handler_)
         SetMouseHandler(NULL);
       else
         gesture_handler_ = NULL;
     }
@@ skipping 67 matching lines @@
        gesture_handler_ && (gesture_handler_ != this);
        gesture_handler_ = gesture_handler_->parent()) {
     if (!gesture_handler_->enabled()) {
       // Disabled views eat events but are treated as not handled.
       return;
     }
 
     // See if this view wants to handle the Gesture.
     ui::GestureEvent gesture_event(*event, static_cast<View*>(this),
                                    gesture_handler_);
-    DispatchEventToTarget(gesture_handler_, &gesture_event);
+    ui::EventDispatchDetails dispatch_details =
+        DispatchEventToTarget(gesture_handler_, &gesture_event);
+    if (dispatch_details.dispatcher_destroyed)
+      return;
 
     // The view could have removed itself from the tree when handling
     // OnGestureEvent(). So handle as per OnMousePressed. NB: we
     // assume that the RootView itself cannot be so removed.
     if (!gesture_handler_)
       return;
 
     if (gesture_event.handled()) {
       if (gesture_event.type() == ui::ET_GESTURE_SCROLL_BEGIN)
         scroll_gesture_handler_ = gesture_handler_;
@@ skipping 114 matching lines @@
     // See if this view wants to handle the mouse press.
     ui::MouseEvent mouse_pressed_event(event, static_cast<View*>(this),
                                        mouse_pressed_handler_);
 
     // Remove the double-click flag if the handler is different than the
     // one which got the first click part of the double-click.
     if (mouse_pressed_handler_ != last_click_handler_)
       mouse_pressed_event.set_flags(event.flags() & ~ui::EF_IS_DOUBLE_CLICK);
 
     drag_info_.Reset();
-    {
-      WidgetDeletionObserver widget_deletion_observer(widget_);
-      DispatchEventToTarget(mouse_pressed_handler_, &mouse_pressed_event);
-      if (!widget_deletion_observer.IsWidgetAlive())
-        return mouse_pressed_event.handled();
-    }
+    ui::EventDispatchDetails dispatch_details =
+        DispatchEventToTarget(mouse_pressed_handler_, &mouse_pressed_event);
+    if (dispatch_details.dispatcher_destroyed)
+      return mouse_pressed_event.handled();
 
     // The view could have removed itself from the tree when handling
     // OnMousePressed().  In this case, the removal notification will have
     // reset mouse_pressed_handler_ to NULL out from under us.  Detect this
     // case and stop.  (See comments in view.h.)
     //
     // NOTE: Don't return true here, because we don't want the frame to
     // forward future events to us when there's no handler.
     if (!mouse_pressed_handler_)
       break;
@@ skipping 37 matching lines @@
 void RootView::OnMouseReleased(const ui::MouseEvent& event) {
   UpdateCursor(event);
 
   if (mouse_pressed_handler_) {
     ui::MouseEvent mouse_released(event, static_cast<View*>(this),
                                   mouse_pressed_handler_);
     // We allow the view to delete us from the event dispatch callback. As such,
     // configure state such that we're done first, then call View.
     View* mouse_pressed_handler = mouse_pressed_handler_;
     SetMouseHandler(NULL);
     DispatchEventToTarget(mouse_pressed_handler, &mouse_released);

[pkotwicz, 2014/02/19 20:14:13]

I did not make DispatchEventToTarget() have WARN_UNUSED_RESULT because we do not
want to use the result here.

[sadrul, 2014/02/19 20:25:10]

We should use the result here (like we do in RootWindow::ProcessedTouchEvent,
for example)

     // WARNING: we may have been deleted.
   }
 }
 
 void RootView::OnMouseCaptureLost() {
   // TODO: this likely needs to reset touch handler too.
 
   if (mouse_pressed_handler_ || gesture_handler_) {
     // Synthesize a release event for UpdateCursor.
     if (mouse_pressed_handler_) {
@@ skipping 171 matching lines @@
     widget_->SetCursor(v->GetCursor(me));
   }
 }
 
 void RootView::SetMouseLocationAndFlags(const ui::MouseEvent& event) {
   last_mouse_event_flags_ = event.flags();
   last_mouse_event_x_ = event.x();
   last_mouse_event_y_ = event.y();
 }
 
-void RootView::DispatchEventToTarget(View* target, ui::Event* event) {
+ui::EventDispatchDetails RootView::DispatchEventToTarget(View* target,
+                                                         ui::Event* event) {
   View* old_target = event_dispatch_target_;
   event_dispatch_target_ = target;
   ui::EventDispatchDetails details = DispatchEvent(target, event);
   if (!details.dispatcher_destroyed)
     event_dispatch_target_ = old_target;
+  return details;
 }
 
 void RootView::NotifyEnterExitOfDescendant(const ui::MouseEvent& event,
                                            ui::EventType type,
                                            View* view,
                                            View* sibling) {
   for (View* p = view->parent(); p; p = p->parent()) {
     if (!p->notify_enter_exit_on_child())
       continue;
     if (sibling && p->Contains(sibling))
@@ skipping 18 matching lines @@
       return;
   }
 }
 
 bool RootView::CanDispatchToTarget(ui::EventTarget* target) {
   return event_dispatch_target_ == target;
 }
 
 }  // namespace internal
 }  // namespace views