Stop MenuItemView From Directly Caching MenuController

ui/views/controls/menu/menu_controller_unittest.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "ui/views/controls/menu/menu_controller.h"
 
 #include "base/callback.h"
 #include "base/logging.h"
 #include "base/macros.h"
 #include "base/single_thread_task_runner.h"
 #include "base/strings/utf_string_conversions.h"
 #include "base/threading/thread_task_runner_handle.h"
 #include "build/build_config.h"
 #include "ui/aura/scoped_window_targeter.h"
 #include "ui/aura/window.h"
 #include "ui/events/event.h"
 #include "ui/events/event_constants.h"
 #include "ui/events/event_handler.h"
 #include "ui/events/event_utils.h"
 #include "ui/events/null_event_targeter.h"
 #include "ui/events/test/event_generator.h"
 #include "ui/gfx/geometry/point.h"
 #include "ui/gfx/geometry/rect.h"
 #include "ui/views/controls/menu/menu_controller_delegate.h"
 #include "ui/views/controls/menu/menu_delegate.h"
 #include "ui/views/controls/menu/menu_host.h"
+#include "ui/views/controls/menu/menu_host_root_view.h"
 #include "ui/views/controls/menu/menu_item_view.h"
 #include "ui/views/controls/menu/menu_message_loop.h"
 #include "ui/views/controls/menu/menu_scroll_view_container.h"
 #include "ui/views/controls/menu/submenu_view.h"
 #include "ui/views/test/menu_test_utils.h"
 #include "ui/views/test/test_views_delegate.h"
 #include "ui/views/test/views_test_base.h"
+#include "ui/views/widget/root_view.h"
 
 #if defined(USE_AURA)
 #include "ui/aura/client/drag_drop_client.h"
 #include "ui/aura/scoped_window_targeter.h"
 #include "ui/aura/window.h"
 #include "ui/views/controls/menu/menu_pre_target_handler.h"
 #endif
 
 #if defined(USE_X11)
 #include <X11/Xlib.h>
@@ skipping 455 matching lines @@
   internal::MenuControllerDelegate* GetCurrentDelegate() {
     return menu_controller_->delegate_;
   }
 
   bool IsAsyncRun() { return menu_controller_->async_run_; }
 
   bool IsShowing() { return menu_controller_->showing_; }
 
   MenuHost* GetMenuHost(SubmenuView* submenu) { return submenu->host_; }
 
+  MenuHostRootView* CreateMenuHostRootView(MenuHost* host) {
+    return static_cast<MenuHostRootView*>(host->CreateRootView());
+  }
+
   void MenuHostOnDragWillStart(MenuHost* host) { host->OnDragWillStart(); }
 
   void MenuHostOnDragComplete(MenuHost* host) { host->OnDragComplete(); }
 
   void SelectByChar(base::char16 character) {
     menu_controller_->SelectByChar(character);
   }
 
   void SetDropMenuItem(MenuItemView* target,
                        MenuDelegate::DropPosition position) {
@@ skipping 81 matching lines @@
 
   void SetHotTrackedButton(CustomButton* hot_button) {
     menu_controller_->SetHotTrackedButton(hot_button);
   }
 
   void ExitMenuRun() {
     menu_controller_->SetExitType(MenuController::ExitType::EXIT_OUTERMOST);
     menu_controller_->ExitMenuRun();
   }
 
- private:
   void DestroyMenuController() {
     if (!menu_controller_)
       return;
 
     if (!owner_->IsClosed())
       owner_->RemoveObserver(menu_controller_);
 
     menu_controller_->showing_ = false;
     menu_controller_->owner_ = nullptr;
     delete menu_controller_;
     menu_controller_ = nullptr;
   }
 
+ private:
   void Init() {
     owner_.reset(new Widget);
     Widget::InitParams params = CreateParams(Widget::InitParams::TYPE_POPUP);
     params.ownership = Widget::InitParams::WIDGET_OWNS_NATIVE_WIDGET;
     owner_->Init(params);
     event_generator_.reset(
         new ui::test::EventGenerator(owner_->GetNativeWindow()));
     owner_->Show();
 
     SetupMenuItem();
@@ skipping 551 matching lines @@
 
   SubmenuView* submenu = menu_item()->GetSubmenu();
   submenu->ShowAt(owner(), menu_item()->bounds(), false);
   MenuHost* host = GetMenuHost(submenu);
   MenuHostOnDragWillStart(host);
   submenu->Close();
   DestroyMenuItem();
   MenuHostOnDragComplete(host);
 }
 
+// Widget destruction and cleanup occurs on the MessageLoop after the
+// MenuController has been destroyed. A MenuHostRootView should not attempt to
+// access a destroyed MenuController. This test should not cause a crash.
+TEST_F(MenuControllerTest, HostReceivesInputBeforeDestruction) {
+  MenuController* controller = menu_controller();
+  controller->SetAsyncRun(true);
+
+  SubmenuView* submenu = menu_item()->GetSubmenu();
+  submenu->ShowAt(owner(), menu_item()->bounds(), false);
+  gfx::Point location(submenu->bounds().bottom_right());
+  location.Offset(1, 1);
+
+  MenuHost* host = GetMenuHost(submenu);
+  MenuHostRootView* root_view = CreateMenuHostRootView(host);
+  DestroyMenuController();
+
+  ui::MouseEvent event(ui::ET_MOUSE_MOVED, location, location,
+                       ui::EventTimeForNow(), ui::EF_LEFT_MOUSE_BUTTON, 0);
+
+  root_view->OnMouseMoved(event);
+}
+
 // Tets that an asynchronous menu nested within an asynchronous menu closes both
 // menus, and notifies both delegates.
 TEST_F(MenuControllerTest, DoubleAsynchronousNested) {
   MenuController* controller = menu_controller();
   TestMenuControllerDelegate* delegate = menu_controller_delegate();
   std::unique_ptr<TestMenuControllerDelegate> nested_delegate(
       new TestMenuControllerDelegate());
 
   ASSERT_FALSE(IsAsyncRun());
   // Sets the run created in SetUp
@@ skipping 309 matching lines @@
       controller->Run(owner(), nullptr, menu_item(), gfx::Rect(),
                       MENU_ANCHOR_TOPLEFT, false, false, &mouse_event_flags);
   EXPECT_EQ(run_result, nullptr);
   TestDestroyedDuringViewsRelease();
 }
 
 #endif  // defined(USE_AURA)
 
 }  // namespace test
 }  // namespace views