MacViews: Explicitly release mouse capture in BridgedNativeWidget::OnWindowWillClose().

ui/views/cocoa/bridged_native_widget.mm

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #import "ui/views/cocoa/bridged_native_widget.h"
 
 #import <objc/runtime.h>
 #include <stddef.h>
 #include <stdint.h>
 
@@ skipping 345 matching lines @@
     // called and the window is still open. Usually, -[NSWindow close] would
     // synchronously call OnWindowWillClose() which removes the delegate and
     // notifies NativeWidgetMac, which then calls this with a nil delegate.
     // For other teardown flows (e.g. Widget::WIDGET_OWNS_NATIVE_WIDGET or
     // Widget::CloseNow()) the delegate must first be cleared to avoid AppKit
     // calling back into the bridge. This means OnWindowWillClose() needs to be
     // invoked manually, which is done below.
     // Note that if the window has children it can't be closed until the
     // children are gone, but removing child windows calls into AppKit for the
     // parent window, so the delegate must be cleared first.
     [window_ setDelegate:nil];

[karandeepb, 2016/06/24 05:34:36]

Is setting the delegate to nil so early really necessary, instead of in
OnWindowWillClose()?

     close_window = true;
   }
 
   RemoveOrDestroyChildren();
   DCHECK(child_windows_.empty());
   SetFocusManager(nullptr);
   SetRootView(nullptr);
   DestroyCompositor();
 
   if (close_window) {
     OnWindowWillClose();
     [window_ close];

[karandeepb, 2016/06/24 05:34:36]

This does not do a [window_ orderOut:nil] like in NativeWidgetMac::Close(). Is
this intentional? Had we did a orderOut with a non-nil delegate, this bug would
not have been caused, since we release capture when visibility state is set to
hidden.

   }
 }
 
 void BridgedNativeWidget::Init(base::scoped_nsobject<NSWindow> window,
                                const Widget::InitParams& params) {
   widget_type_ = params.type;
 
   DCHECK(!window_);
   window_.swap(window);
   [window_ setDelegate:window_delegate_];
@@ skipping 278 matching lines @@
 void* BridgedNativeWidget::GetNativeWindowProperty(const char* name) const {
   NSString* key = [NSString stringWithUTF8String:name];
   return [[GetWindowProperties() objectForKey:key] pointerValue];
 }
 
 void BridgedNativeWidget::SetCursor(NSCursor* cursor) {
   [window_delegate_ setCursor:cursor];
 }
 
 void BridgedNativeWidget::OnWindowWillClose() {
+  // Ensure BridgedNativeWidget does not have capture, otherwise
+  // OnMouseCaptureLost() may reference a deleted |native_widget_mac_| when
+  // called via ~CocoaMouseCapture() upon the destruction of |mouse_capture_|.
+  // See crbug.com/622201. Also we do this before setting the delegate to nil,
+  // because this may lead to callbacks to bridge which rely on a valid
+  // delegate.
+  ReleaseCapture();
+
   if (parent_) {
     parent_->RemoveChildWindow(this);
     parent_ = nullptr;
   }
   [window_ setDelegate:nil];
   [[NSNotificationCenter defaultCenter] removeObserver:window_delegate_];
   native_widget_mac_->OnWindowWillClose();
 }
 
 void BridgedNativeWidget::OnFullscreenTransitionStart(
@@ skipping 101 matching lines @@
   // If arriving via SetVisible(), |wants_to_be_visible_| should already be set.
   // If made visible externally (e.g. Cmd+H), just roll with it. Don't try (yet)
   // to distinguish being *hidden* externally from being hidden by a parent
   // window - we might not need that.
   if (window_visible_) {
     wants_to_be_visible_ = true;
 
     if (parent_)
       [parent_->GetNSWindow() addChildWindow:window_ ordered:NSWindowAbove];
   } else {
-    mouse_capture_.reset();  // Capture on hidden windows is not permitted.
+    ReleaseCapture();  // Capture on hidden windows is not permitted.
 
     // When becoming invisible, remove the entry in any parent's childWindow
     // list. Cocoa's childWindow management breaks down when child windows are
     // hidden.
     if (parent_)
       [parent_->GetNSWindow() removeChildWindow:window_];
   }
 
   // TODO(tapted): Investigate whether we want this for Mac. This is what Aura
   // does, and it is what tests expect. However, because layer drawing is
@@ skipping 536 matching lines @@
   [bridged_view_ setMouseDownCanMoveWindow:draggable];
   // AppKit will not update its cache of mouseDownCanMoveWindow unless something
   // changes. Previously we tried adding an NSView and removing it, but for some
   // reason it required reposting the mouse-down event, and didn't always work.
   // Calling the below seems to be an effective solution.
   [window_ setMovableByWindowBackground:NO];
   [window_ setMovableByWindowBackground:YES];
 }
 
 }  // namespace views