Fix crash which occurs when a widget destroys itself as a result of ET_GESTURE_TAP_DOWN

ui/views/widget/root_view.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "ui/views/widget/root_view.h"
 
 #include <algorithm>
 
 #include "base/logging.h"
 #include "base/message_loop/message_loop.h"
 #include "ui/base/accessibility/accessible_view_state.h"
 #include "ui/base/dragdrop/drag_drop_types.h"
 #include "ui/compositor/layer.h"
 #include "ui/events/event.h"
 #include "ui/events/keycodes/keyboard_codes.h"
 #include "ui/gfx/canvas.h"
 #include "ui/views/focus/view_storage.h"
 #include "ui/views/layout/fill_layout.h"
 #include "ui/views/views_switches.h"
 #include "ui/views/widget/widget.h"
 #include "ui/views/widget/widget_delegate.h"
-#include "ui/views/widget/widget_deletion_observer.h"
 
 #if defined(USE_AURA)
 #include "ui/base/cursor/cursor.h"
 #endif
 
 namespace views {
 namespace internal {
 
 namespace {
 
@@ skipping 101 matching lines @@
     event->StopPropagation();
     return;
   }
 
   DispatchKeyEventStartAt(v, event);
 }
 
 void RootView::DispatchScrollEvent(ui::ScrollEvent* event) {
   for (View* v = GetEventHandlerForPoint(event->location());
        v && v != this && !event->stopped_propagation(); v = v->parent()) {
-    DispatchEventToTarget(v, event);
+    ui::EventDispatchDetails dispatch_details = DispatchEventToTarget(v, event);
+    if (dispatch_details.dispatcher_destroyed ||
+        dispatch_details.target_destroyed) {
+      return;
+    }
   }
 
   if (event->handled() || event->type() != ui::ET_SCROLL)
     return;
 
   // Convert unprocessed scroll events into mouse-wheel events.
   ui::MouseWheelEvent wheel(*event);
   if (OnMouseWheel(wheel))
     event->SetHandled();
 }
 
 void RootView::DispatchTouchEvent(ui::TouchEvent* event) {
   // TODO: this looks all wrong. On a TOUCH_PRESSED we should figure out the
   // view and target that view with all touches with the same id until the
   // release (or keep it if captured).
 
   // If touch_pressed_handler_ is non null, we are currently processing
   // a touch down on the screen situation. In that case we send the
   // event to touch_pressed_handler_
 
   if (touch_pressed_handler_) {
     ui::TouchEvent touch_event(*event, static_cast<View*>(this),
                                touch_pressed_handler_);
-    DispatchEventToTarget(touch_pressed_handler_, &touch_event);
+    ui::EventDispatchDetails dispatch_details =
+        DispatchEventToTarget(touch_pressed_handler_, &touch_event);
     if (touch_event.handled())
       event->SetHandled();
     if (touch_event.stopped_propagation())
       event->StopPropagation();
+    if (dispatch_details.dispatcher_destroyed)
+      return;
     return;
   }
 
   // Walk up the tree until we find a view that wants the touch event.
   for (touch_pressed_handler_ = GetEventHandlerForPoint(event->location());
        touch_pressed_handler_ && (touch_pressed_handler_ != this);
        touch_pressed_handler_ = touch_pressed_handler_->parent()) {
     if (!touch_pressed_handler_->enabled()) {
       // Disabled views eat events but are treated as not handled.
       break;
     }
 
     // See if this view wants to handle the touch
     ui::TouchEvent touch_event(*event, static_cast<View*>(this),
                                touch_pressed_handler_);
-    DispatchEventToTarget(touch_pressed_handler_, &touch_event);
+    ui::EventDispatchDetails dispatch_details =
+        DispatchEventToTarget(touch_pressed_handler_, &touch_event);
     if (touch_event.handled())
       event->SetHandled();
     if (touch_event.stopped_propagation())
       event->StopPropagation();
+    if (dispatch_details.dispatcher_destroyed)
+      return;
 
     // The view could have removed itself from the tree when handling
     // OnTouchEvent(). So handle as per OnMousePressed. NB: we
     // assume that the RootView itself cannot be so removed.
     if (!touch_pressed_handler_)
       break;
 
     // The touch event wasn't processed. Go up the view hierarchy and dispatch
     // the touch event.
     if (!event->handled())
@@ skipping 14 matching lines @@
 }
 
 void RootView::DispatchGestureEvent(ui::GestureEvent* event) {
   if (gesture_handler_) {
     // |gesture_handler_| (or |scroll_gesture_handler_|) can be deleted during
     // processing.
     View* handler = scroll_gesture_handler_ &&
         (event->IsScrollGestureEvent() || event->IsFlingScrollEvent())  ?
             scroll_gesture_handler_ : gesture_handler_;
     ui::GestureEvent handler_event(*event, static_cast<View*>(this), handler);
-    DispatchEventToTarget(handler, &handler_event);
+    ui::EventDispatchDetails dispatch_details =
+        DispatchEventToTarget(handler, &handler_event);
+    if (dispatch_details.dispatcher_destroyed)
+      return;
 
     if (event->type() == ui::ET_GESTURE_END &&
         event->details().touch_points() <= 1) {
       // In case a drag was in progress, reset all the handlers. Otherwise, just
       // reset the gesture handler.
       if (gesture_handler_ == mouse_pressed_handler_)
         SetMouseHandler(NULL);
       else
         gesture_handler_ = NULL;
     }
@@ skipping 16 matching lines @@
         !scroll_gesture_handler_) {
       // Some view started processing gesture events, however it does not
       // process scroll-gesture events. In such case, we allow the event to
       // bubble up, and install a different scroll-gesture handler different
       // from the default gesture handler.
       for (scroll_gesture_handler_ = gesture_handler_->parent();
           scroll_gesture_handler_ && scroll_gesture_handler_ != this;
           scroll_gesture_handler_ = scroll_gesture_handler_->parent()) {
         ui::GestureEvent gesture_event(*event, static_cast<View*>(this),
                                        scroll_gesture_handler_);
-        DispatchEventToTarget(scroll_gesture_handler_, &gesture_event);
+        ui::EventDispatchDetails dispatch_details =
+            DispatchEventToTarget(scroll_gesture_handler_, &gesture_event);
         if (gesture_event.stopped_propagation()) {
           event->StopPropagation();
           return;
         } else if (gesture_event.handled()) {
           event->SetHandled();
           return;
+        } else if (dispatch_details.dispatcher_destroyed) {
+          return;
         }
       }
       scroll_gesture_handler_ = NULL;
     }
 
     return;
   }
 
   // If there was no handler for a SCROLL_BEGIN event, then subsequent scroll
   // events are not dispatched to any views.
@@ skipping 24 matching lines @@
        gesture_handler_ && (gesture_handler_ != this);
        gesture_handler_ = gesture_handler_->parent()) {
     if (!gesture_handler_->enabled()) {
       // Disabled views eat events but are treated as not handled.
       return;
     }
 
     // See if this view wants to handle the Gesture.
     ui::GestureEvent gesture_event(*event, static_cast<View*>(this),
                                    gesture_handler_);
-    DispatchEventToTarget(gesture_handler_, &gesture_event);
+    ui::EventDispatchDetails dispatch_details =
+        DispatchEventToTarget(gesture_handler_, &gesture_event);
+    if (dispatch_details.dispatcher_destroyed)
+      return;
 
     // The view could have removed itself from the tree when handling
     // OnGestureEvent(). So handle as per OnMousePressed. NB: we
     // assume that the RootView itself cannot be so removed.
     if (!gesture_handler_)
       return;
 
     if (gesture_event.handled()) {
       if (gesture_event.type() == ui::ET_GESTURE_SCROLL_BEGIN)
         scroll_gesture_handler_ = gesture_handler_;
@@ skipping 86 matching lines @@
   UpdateCursor(event);
   SetMouseLocationAndFlags(event);
 
   // If mouse_pressed_handler_ is non null, we are currently processing
   // a pressed -> drag -> released session. In that case we send the
   // event to mouse_pressed_handler_
   if (mouse_pressed_handler_) {
     ui::MouseEvent mouse_pressed_event(event, static_cast<View*>(this),
                                        mouse_pressed_handler_);
     drag_info_.Reset();
-    DispatchEventToTarget(mouse_pressed_handler_, &mouse_pressed_event);
+    ui::EventDispatchDetails dispatch_details =
+        DispatchEventToTarget(mouse_pressed_handler_, &mouse_pressed_event);
+    if (dispatch_details.dispatcher_destroyed)
+      return true;
     return true;
   }
   DCHECK(!explicit_mouse_handler_);
 
   bool hit_disabled_view = false;
   // Walk up the tree until we find a view that wants the mouse event.
   for (mouse_pressed_handler_ = GetEventHandlerForPoint(event.location());
        mouse_pressed_handler_ && (mouse_pressed_handler_ != this);
        mouse_pressed_handler_ = mouse_pressed_handler_->parent()) {
     DVLOG(1) << "OnMousePressed testing "
         << mouse_pressed_handler_->GetClassName();
     if (!mouse_pressed_handler_->enabled()) {
       // Disabled views should eat events instead of propagating them upwards.
       hit_disabled_view = true;
       break;
     }
 
     // See if this view wants to handle the mouse press.
     ui::MouseEvent mouse_pressed_event(event, static_cast<View*>(this),
                                        mouse_pressed_handler_);
 
     // Remove the double-click flag if the handler is different than the
     // one which got the first click part of the double-click.
     if (mouse_pressed_handler_ != last_click_handler_)
       mouse_pressed_event.set_flags(event.flags() & ~ui::EF_IS_DOUBLE_CLICK);
 
     drag_info_.Reset();
-    {
-      WidgetDeletionObserver widget_deletion_observer(widget_);
-      DispatchEventToTarget(mouse_pressed_handler_, &mouse_pressed_event);
-      if (!widget_deletion_observer.IsWidgetAlive())
-        return mouse_pressed_event.handled();
-    }
+    ui::EventDispatchDetails dispatch_details =
+        DispatchEventToTarget(mouse_pressed_handler_, &mouse_pressed_event);
+    if (dispatch_details.dispatcher_destroyed)
+      return mouse_pressed_event.handled();
 
     // The view could have removed itself from the tree when handling
     // OnMousePressed().  In this case, the removal notification will have
     // reset mouse_pressed_handler_ to NULL out from under us.  Detect this
     // case and stop.  (See comments in view.h.)
     //
     // NOTE: Don't return true here, because we don't want the frame to
     // forward future events to us when there's no handler.
     if (!mouse_pressed_handler_)
       break;
@@ skipping 22 matching lines @@
   last_click_handler_ = NULL;
   return hit_disabled_view;
 }
 
 bool RootView::OnMouseDragged(const ui::MouseEvent& event) {
   if (mouse_pressed_handler_) {
     SetMouseLocationAndFlags(event);
 
     ui::MouseEvent mouse_event(event, static_cast<View*>(this),
                                mouse_pressed_handler_);
-    DispatchEventToTarget(mouse_pressed_handler_, &mouse_event);
+    ui::EventDispatchDetails dispatch_details =
+        DispatchEventToTarget(mouse_pressed_handler_, &mouse_event);
+    if (dispatch_details.dispatcher_destroyed)
+      return false;
   }
   return false;
 }
 
 void RootView::OnMouseReleased(const ui::MouseEvent& event) {
   UpdateCursor(event);
 
   if (mouse_pressed_handler_) {
     ui::MouseEvent mouse_released(event, static_cast<View*>(this),
                                   mouse_pressed_handler_);
     // We allow the view to delete us from the event dispatch callback. As such,
     // configure state such that we're done first, then call View.
     View* mouse_pressed_handler = mouse_pressed_handler_;
     SetMouseHandler(NULL);
-    DispatchEventToTarget(mouse_pressed_handler, &mouse_released);
-    // WARNING: we may have been deleted.
+    ui::EventDispatchDetails dispatch_details =
+        DispatchEventToTarget(mouse_pressed_handler, &mouse_released);
+    if (dispatch_details.dispatcher_destroyed)
+      return;
   }
 }
 
 void RootView::OnMouseCaptureLost() {
   // TODO: this likely needs to reset touch handler too.
 
   if (mouse_pressed_handler_ || gesture_handler_) {
     // Synthesize a release event for UpdateCursor.
     if (mouse_pressed_handler_) {
       gfx::Point last_point(last_mouse_event_x_, last_mouse_event_y_);
@@ skipping 23 matching lines @@
   // disabled while handling moves, it's wrong to suddenly send ET_MOUSE_EXITED
   // and ET_MOUSE_ENTERED events, because the mouse hasn't actually exited yet.
   while (v && !v->enabled() && (v != mouse_move_handler_))
     v = v->parent();
   if (v && v != this) {
     if (v != mouse_move_handler_) {
       if (mouse_move_handler_ != NULL &&
           (!mouse_move_handler_->notify_enter_exit_on_child() ||
            !mouse_move_handler_->Contains(v))) {
         MouseEnterExitEvent exit(event, ui::ET_MOUSE_EXITED);
-        DispatchEventToTarget(mouse_move_handler_, &exit);
+        ui::EventDispatchDetails dispatch_details =
+            DispatchEventToTarget(mouse_move_handler_, &exit);
+        if (dispatch_details.dispatcher_destroyed)
+          return;
         NotifyEnterExitOfDescendant(event, ui::ET_MOUSE_EXITED,
             mouse_move_handler_, v);
       }
       View* old_handler = mouse_move_handler_;
       mouse_move_handler_ = v;
       if (!mouse_move_handler_->notify_enter_exit_on_child() ||
           !mouse_move_handler_->Contains(old_handler)) {
         MouseEnterExitEvent entered(event, ui::ET_MOUSE_ENTERED);
         entered.ConvertLocationToTarget(static_cast<View*>(this),
                                         mouse_move_handler_);
-        DispatchEventToTarget(mouse_move_handler_, &entered);
+        ui::EventDispatchDetails dispatch_details =
+            DispatchEventToTarget(mouse_move_handler_, &entered);
+        if (dispatch_details.dispatcher_destroyed)
+          return;
         NotifyEnterExitOfDescendant(entered, ui::ET_MOUSE_ENTERED, v,
             old_handler);
       }
     }
     ui::MouseEvent moved_event(event, static_cast<View*>(this),
                                mouse_move_handler_);
     mouse_move_handler_->OnMouseMoved(moved_event);
     if (!(moved_event.flags() & ui::EF_IS_NON_CLIENT))
       widget_->SetCursor(mouse_move_handler_->GetCursor(moved_event));
   } else if (mouse_move_handler_ != NULL) {
     MouseEnterExitEvent exited(event, ui::ET_MOUSE_EXITED);
-    DispatchEventToTarget(mouse_move_handler_, &exited);
+    ui::EventDispatchDetails dispatch_details =
+        DispatchEventToTarget(mouse_move_handler_, &exited);
+    if (dispatch_details.dispatcher_destroyed)
+      return;
     NotifyEnterExitOfDescendant(event, ui::ET_MOUSE_EXITED,
         mouse_move_handler_, v);
     // On Aura the non-client area extends slightly outside the root view for
     // some windows.  Let the non-client cursor handling code set the cursor
     // as we do above.
     if (!(event.flags() & ui::EF_IS_NON_CLIENT))
       widget_->SetCursor(gfx::kNullCursor);
     mouse_move_handler_ = NULL;
   }
 }
 
 void RootView::OnMouseExited(const ui::MouseEvent& event) {
   if (mouse_move_handler_ != NULL) {
     MouseEnterExitEvent exited(event, ui::ET_MOUSE_EXITED);
-    DispatchEventToTarget(mouse_move_handler_, &exited);
+    ui::EventDispatchDetails dispatch_details =
+        DispatchEventToTarget(mouse_move_handler_, &exited);
+    if (dispatch_details.dispatcher_destroyed)
+      return;
     NotifyEnterExitOfDescendant(event, ui::ET_MOUSE_EXITED,
         mouse_move_handler_, NULL);
     mouse_move_handler_ = NULL;
   }
 }
 
 bool RootView::OnMouseWheel(const ui::MouseWheelEvent& event) {
   for (View* v = GetEventHandlerForPoint(event.location());
-       v && v != this && !event.handled(); v = v->parent())
-    DispatchEventToTarget(v, const_cast<ui::MouseWheelEvent*>(&event));
+       v && v != this && !event.handled(); v = v->parent()) {
+    ui::EventDispatchDetails dispatch_details =
+        DispatchEventToTarget(v, const_cast<ui::MouseWheelEvent*>(&event));
+    if (dispatch_details.dispatcher_destroyed ||
+        dispatch_details.target_destroyed) {
+      return event.handled();
+    }
+  }
   return event.handled();
 }
 
 void RootView::SetMouseHandler(View* new_mh) {
   // If we're clearing the mouse handler, clear explicit_mouse_handler_ as well.
   explicit_mouse_handler_ = (new_mh != NULL);
   mouse_pressed_handler_ = new_mh;
   gesture_handler_ = new_mh;
   scroll_gesture_handler_ = new_mh;
   drag_info_.Reset();
@@ skipping 78 matching lines @@
     widget_->SetCursor(v->GetCursor(me));
   }
 }
 
 void RootView::SetMouseLocationAndFlags(const ui::MouseEvent& event) {
   last_mouse_event_flags_ = event.flags();
   last_mouse_event_x_ = event.x();
   last_mouse_event_y_ = event.y();
 }
 
-void RootView::DispatchEventToTarget(View* target, ui::Event* event) {
+ui::EventDispatchDetails RootView::DispatchEventToTarget(View* target,
+                                                         ui::Event* event) {
   View* old_target = event_dispatch_target_;
   event_dispatch_target_ = target;
   ui::EventDispatchDetails details = DispatchEvent(target, event);
   if (!details.dispatcher_destroyed)
     event_dispatch_target_ = old_target;
+  return details;
 }
 
 void RootView::NotifyEnterExitOfDescendant(const ui::MouseEvent& event,
                                            ui::EventType type,
                                            View* view,
                                            View* sibling) {
   for (View* p = view->parent(); p; p = p->parent()) {
     if (!p->notify_enter_exit_on_child())
       continue;
     if (sibling && p->Contains(sibling))
       break;
     // It is necessary to recreate the notify-event for each dispatch, since one
     // of the callbacks can mark the event as handled, and that would cause
     // incorrect event dispatch.
     MouseEnterExitEvent notify_event(event, type);
-    DispatchEventToTarget(p, &notify_event);
+    ui::EventDispatchDetails dispatch_details =
+        DispatchEventToTarget(p, &notify_event);
+    if (dispatch_details.dispatcher_destroyed ||
+        dispatch_details.target_destroyed) {
+      return;
+    }
   }
 }
 
 
 void RootView::DispatchKeyEventStartAt(View* view, ui::KeyEvent* event) {
-  if (event->handled() || !view)
-    return;
-
-  for (; view && view != this; view = view->parent()) {
-    DispatchEventToTarget(view, event);
-    // Do this check here rather than in the if as |view| may have been deleted.
-    if (event->handled())
+  for (; view && view != this && !event->handled(); view = view->parent()) {
+    ui::EventDispatchDetails dispatch_details =
+        DispatchEventToTarget(view, event);
+    if (dispatch_details.dispatcher_destroyed ||

[sadrul, 2014/02/20 15:45:49]

Perhaps we are not setting |target_destroyed| correctly on dispatch_details. So
it would be better to check event->handled() in this if too, before the code
executes view = view->parent()

+        dispatch_details.target_destroyed) {
       return;
+    }
   }
 }
 
 bool RootView::CanDispatchToTarget(ui::EventTarget* target) {
   return event_dispatch_target_ == target;
 }
 
 }  // namespace internal
 }  // namespace views