Fix crash which occurs when a widget destroys itself as a result of ET_GESTURE_TAP_DOWN

ui/views/widget/root_view.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "ui/views/widget/root_view.h"
 
 #include <algorithm>
 
 #include "base/logging.h"
 #include "base/message_loop/message_loop.h"
@@ skipping 206 matching lines @@
 }
 
 void RootView::DispatchGestureEvent(ui::GestureEvent* event) {
   if (gesture_handler_) {
     // |gesture_handler_| (or |scroll_gesture_handler_|) can be deleted during
     // processing.
     View* handler = scroll_gesture_handler_ &&
         (event->IsScrollGestureEvent() || event->IsFlingScrollEvent())  ?
             scroll_gesture_handler_ : gesture_handler_;
     ui::GestureEvent handler_event(*event, static_cast<View*>(this), handler);
-    DispatchEventToTarget(handler, &handler_event);
+
+    {
+      WidgetDeletionObserver widget_deletion_observer(widget_);
+      DispatchEventToTarget(handler, &handler_event);

[sadrul, 2014/02/18 12:53:26]

This is also an issue for other kinds of event dispatch, right?

The better fix would be to have DispatchEventToTarget return the
EventDispatchDetails, and look at dispatcher_destroyed

+      if (!widget_deletion_observer.IsWidgetAlive())
+        return;
+    }
 
     if (event->type() == ui::ET_GESTURE_END &&
         event->details().touch_points() <= 1) {
       // In case a drag was in progress, reset all the handlers. Otherwise, just
       // reset the gesture handler.
       if (gesture_handler_ == mouse_pressed_handler_)
         SetMouseHandler(NULL);
       else
         gesture_handler_ = NULL;
     }
@@ skipping 67 matching lines @@
        gesture_handler_ && (gesture_handler_ != this);
        gesture_handler_ = gesture_handler_->parent()) {
     if (!gesture_handler_->enabled()) {
       // Disabled views eat events but are treated as not handled.
       return;
     }
 
     // See if this view wants to handle the Gesture.
     ui::GestureEvent gesture_event(*event, static_cast<View*>(this),
                                    gesture_handler_);
-    DispatchEventToTarget(gesture_handler_, &gesture_event);
+
+    {
+      WidgetDeletionObserver widget_deletion_observer(widget_);
+      DispatchEventToTarget(gesture_handler_, &gesture_event);
+      if (!widget_deletion_observer.IsWidgetAlive())
+        return;
+    }
 
     // The view could have removed itself from the tree when handling
     // OnGestureEvent(). So handle as per OnMousePressed. NB: we
     // assume that the RootView itself cannot be so removed.
     if (!gesture_handler_)
       return;
 
     if (gesture_event.handled()) {
       if (gesture_event.type() == ui::ET_GESTURE_SCROLL_BEGIN)
         scroll_gesture_handler_ = gesture_handler_;
@@ skipping 413 matching lines @@
       return;
   }
 }
 
 bool RootView::CanDispatchToTarget(ui::EventTarget* target) {
   return event_dispatch_target_ == target;
 }
 
 }  // namespace internal
 }  // namespace views