Fixes use after free caused by delete in RootWindowController

ash/root_window_controller.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "ash/root_window_controller.h"
 
 #include <queue>
 #include <vector>
 
 #include "ash/ash_constants.h"
@@ skipping 427 matching lines @@
   aura::client::SetTooltipClient(root_window_.get(), NULL);
 
   // Remove all toplevel windows first.
   std::queue<aura::Window*> non_toplevel_windows;
   non_toplevel_windows.push(root_window_.get());
   while (!non_toplevel_windows.empty()) {
     aura::Window* non_toplevel_window = non_toplevel_windows.front();
     non_toplevel_windows.pop();
     aura::WindowTracker toplevel_windows;
     for (size_t i = 0; i < non_toplevel_window->children().size(); ++i) {
       aura::Window* child = non_toplevel_window->children()[i];

[oshima, 2013/09/30 22:48:57]

can't we skip here like

if (child->owned_by_parent())
  return;

Window::~Window seems to take care of removing child when deleted.

[sky, 2013/09/30 23:14:17]

Done.

       if (child->delegate())
         toplevel_windows.Add(child);
       else
         non_toplevel_windows.push(child);
     }
-    while (!toplevel_windows.windows().empty())
-      delete *toplevel_windows.windows().begin();
+    while (!toplevel_windows.windows().empty()) {
+      aura::Window* window = *(toplevel_windows.windows().begin());
+      if (window->owned_by_parent()) {
+        delete window;
+      } else {
+        toplevel_windows.Remove(window);
+        window->parent()->RemoveChild(window);
+      }
+    }
   }
   // And then remove the containers.
-  while (!root_window_->children().empty())
-    delete root_window_->children()[0];
+  while (!root_window_->children().empty()) {
+    aura::Window* window = root_window_->children()[0];
+    if (window->owned_by_parent()) {
+      delete window;
+    } else {
+      root_window_->RemoveChild(window);
+    }
+  }
 
   shelf_.reset(NULL);
 }
 
 void RootWindowController::MoveWindowsTo(aura::RootWindow* dst) {
   // Forget the shelf early so that shelf don't update itself using wrong
   // display info.
   workspace_controller_->SetShelf(NULL);
   ReparentAllWindows(root_window_.get(), dst);
 }
@@ skipping 354 matching lines @@
     DisableTouchHudProjection();
 }
 
 RootWindowController* GetRootWindowController(
     const aura::RootWindow* root_window) {
   return root_window ? GetRootWindowSettings(root_window)->controller : NULL;
 }
 
 }  // namespace internal
 }  // namespace ash