Adds code to isolate use-after-free in Views

ui/views/focus/focus_manager.h

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef UI_VIEWS_FOCUS_FOCUS_MANAGER_H_
 #define UI_VIEWS_FOCUS_FOCUS_MANAGER_H_
 
 #include <memory>
 
 #include "base/macros.h"
 #include "base/observer_list.h"
 #include "ui/base/accelerators/accelerator_manager.h"
+#include "ui/views/view_observer.h"
 #include "ui/views/views_export.h"
 
 // FocusManager handles focus traversal, stores and restores focused views, and
 // handles keyboard accelerators. This class is an implementation detail of
 // views::. Most callers should use methods of views:: classes rather than using
 // FocusManager directly.
 //
 // There are 2 types of focus:
 //
 // - The native focus, which is the focus that a gfx::NativeView has.
@@ skipping 40 matching lines @@
 //   the parent view that directly contains the native window. This is needed
 //   when traversing up from the nested RootView to know which view to start
 //   with when going to the next/previous view. In the example:
 //
 //     hwnd_view_container_->GetWidget()->SetFocusTraversableParent(
 //         native_control);
 //
 // Note that FocusTraversable views do not have to be RootViews:
 // AccessibleToolbarView is FocusTraversable.
 
+namespace base {
+namespace debug {
+class StackTrace;
+}
+}
+
 namespace ui {
 class Accelerator;
 class AcceleratorTarget;
 class KeyEvent;
 }
 
 namespace views {
 
 class FocusManagerDelegate;
 class FocusSearch;
@@ skipping 28 matching lines @@
   // No change to focus state has occurred yet when this function is called.
   virtual void OnWillChangeFocus(View* focused_before, View* focused_now) = 0;
 
   // Called after focus state has changed.
   virtual void OnDidChangeFocus(View* focused_before, View* focused_now) = 0;
 
  protected:
   virtual ~FocusChangeListener() {}
 };
 
-class VIEWS_EXPORT FocusManager {
+// FocusManager adds itself as a ViewObserver to the currently focused view.
+class VIEWS_EXPORT FocusManager : public ViewObserver {
  public:
   // The reason why the focus changed.
   enum FocusChangeReason {
     // The focus changed because the user traversed focusable views using
     // keys like Tab or Shift+Tab.
     kReasonFocusTraversal,
 
     // The focus changed due to restoring the focus.
     kReasonFocusRestore,
 
     // The focus changed due to a click or a shortcut to jump directly to
     // a particular view.
     kReasonDirectFocusChange
   };
 
   // TODO: use Direction in place of bool reverse throughout.
   enum Direction {
     kForward,
     kBackward
   };
 
   enum FocusCycleWrappingBehavior {
     kWrap,
     kNoWrap
   };
 
   FocusManager(Widget* widget, std::unique_ptr<FocusManagerDelegate> delegate);
-  virtual ~FocusManager();
+  ~FocusManager() override;
 
   // Processes the passed key event for accelerators and keyboard traversal.
   // Returns false if the event has been consumed and should not be processed
   // further.
   bool OnKeyEvent(const ui::KeyEvent& event);
 
   // Returns true is the specified is part of the hierarchy of the window
   // associated with this FocusManager.
   bool ContainsView(View* view);
 
@@ skipping 164 matching lines @@
                           bool reverse);
 
   // Process arrow key traversal. Returns true if the event has been consumed
   // and should not be processed further.
   bool ProcessArrowKeyTraversal(const ui::KeyEvent& event);
 
   // Whether |view| is currently focusable as per the platform's interpretation
   // of |keyboard_accesible_|.
   bool IsFocusable(View* view) const;
 
+  // ViewObserver:
+  void OnViewIsDeleting(View* view) override;
+
   // Whether arrow key traversal is enabled.
   static bool arrow_key_traversal_enabled_;
 
   // The top-level Widget this FocusManager is associated with.
   Widget* widget_;
 
   // The object which handles an accelerator when |accelerator_manager_| doesn't
   // handle it.
   std::unique_ptr<FocusManagerDelegate> delegate_;
 
   // The view that currently is focused.
   View* focused_view_ = nullptr;
 
+  // TODO(sky): remove, used for debugging 687232.
+  std::unique_ptr<base::debug::StackTrace> stack_when_focused_view_set_;
+
   // The AcceleratorManager this FocusManager is associated with.
   ui::AcceleratorManager accelerator_manager_;
 
   // Keeps track of whether shortcut handling is currently suspended.
   bool shortcut_handling_suspended_ = false;
 
   // The storage id used in the ViewStorage to store/restore the view that last
   // had focus.
   const int stored_focused_view_storage_id_;
 
@@ skipping 10 matching lines @@
   // FocusTraversable level. Currently only used on Mac, when Full Keyboard
   // access is enabled.
   bool keyboard_accessible_ = false;
 
   DISALLOW_COPY_AND_ASSIGN(FocusManager);
 };
 
 }  // namespace views
 
 #endif  // UI_VIEWS_FOCUS_FOCUS_MANAGER_H_