Fixes use after free caused by delete in RootWindowController (2)

ash/root_window_controller_unittest.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "ash/root_window_controller.h"
 
 #include "ash/session_state_delegate.h"
 #include "ash/shelf/shelf_layout_manager.h"
 #include "ash/shell.h"
 #include "ash/shell_window_ids.h"
@@ skipping 33 matching lines @@
   virtual views::View* GetContentsView() OVERRIDE {
     return this;
   }
 
   virtual ui::ModalType GetModalType() const OVERRIDE {
     return system_modal_ ? ui::MODAL_TYPE_SYSTEM : ui::MODAL_TYPE_NONE;
   }
 
  private:
   bool system_modal_;
+
   DISALLOW_COPY_AND_ASSIGN(TestDelegate);
 };
 
 class DeleteOnBlurDelegate : public aura::test::TestWindowDelegate,
                              public aura::client::FocusChangeObserver {
  public:
   DeleteOnBlurDelegate() : window_(NULL) {}
   virtual ~DeleteOnBlurDelegate() {}
 
   void SetWindow(aura::Window* window) {
@@ skipping 457 matching lines @@
        ++block_reason) {
     BlockUserSession(static_cast<UserSessionBlockReason>(block_reason));
     lock_window->Focus();
     EXPECT_TRUE(lock_window->HasFocus());
     session_window->Focus();
     EXPECT_FALSE(session_window->HasFocus());
     UnblockUserSession();
   }
 }
 
+// Tracks whether OnWindowDestroying() has been invoked.
+class DestroyedWindowObserver : public aura::WindowObserver {
+ public:
+  DestroyedWindowObserver() : destroyed_(false), window_(NULL) {}
+  virtual ~DestroyedWindowObserver() {
+    Shutdown();
+  }
+
+  void SetWindow(Window* window) {
+    window_ = window;
+    window->AddObserver(this);
+  }
+
+  bool destroyed() const { return destroyed_; }
+
+  // WindowObserver overrides:
+  virtual void OnWindowDestroying(Window* window) OVERRIDE {
+    destroyed_ = true;
+    Shutdown();
+  }
+
+ private:
+  void Shutdown() {
+    if (!window_)
+      return;
+    window_->RemoveObserver(this);
+    window_ = NULL;
+  }
+
+  bool destroyed_;
+  Window* window_;
+
+  DISALLOW_COPY_AND_ASSIGN(DestroyedWindowObserver);
+};
+
+// Verifies shutdown doesn't delete windows that are not owned by the parent.
+TEST_F(RootWindowControllerTest, DontDeleteWindowsNotOwnedByParent) {
+  DestroyedWindowObserver observer1;
+  aura::test::TestWindowDelegate delegate1;
+  aura::Window* window1 = new aura::Window(&delegate1);
+  window1->SetType(aura::client::WINDOW_TYPE_CONTROL);
+  window1->set_owned_by_parent(false);
+  observer1.SetWindow(window1);
+  window1->Init(ui::LAYER_NOT_DRAWN);
+  window1->SetDefaultParentByRootWindow(
+      Shell::GetInstance()->GetPrimaryRootWindow(), gfx::Rect());
+
+  DestroyedWindowObserver observer2;
+  aura::Window* window2 = new aura::Window(NULL);
+  window2->set_owned_by_parent(false);
+  observer2.SetWindow(window2);
+  window2->Init(ui::LAYER_NOT_DRAWN);
+  Shell::GetInstance()->GetPrimaryRootWindow()->AddChild(window2);
+
+  Shell::GetInstance()->GetPrimaryRootWindowController()->CloseChildWindows();
+
+  ASSERT_FALSE(observer1.destroyed());
+  delete window1;
+
+  ASSERT_FALSE(observer2.destroyed());
+  delete window2;
+}
+
 typedef test::NoSessionAshTestBase NoSessionRootWindowControllerTest;
 
 // Make sure that an event handler exists for entire display area.
 TEST_F(NoSessionRootWindowControllerTest, Event) {
   aura::RootWindow* root = Shell::GetPrimaryRootWindow();
   const gfx::Size size = root->bounds().size();
   aura::Window* event_target = root->GetEventHandlerForPoint(gfx::Point(0, 0));
   EXPECT_TRUE(event_target);
   EXPECT_EQ(event_target,
             root->GetEventHandlerForPoint(gfx::Point(0, size.height() - 1)));
@@ skipping 66 matching lines @@
   aura::WindowTracker tracker;
   tracker.Add(keyboard_container);
   // Mock a login state change to reinitialize the keyboard.
   ash::Shell::GetInstance()->OnLoginStateChanged(user::LOGGED_IN_OWNER);
   // keyboard_container should no longer be present.
   EXPECT_FALSE(tracker.Contains(keyboard_container));
 }
 
 }  // namespace test
 }  // namespace ash