[Ozone/x11] events can be dispatched to the wrong window

ui/platform_window/x11/x11_window_ozone.cc

 // Copyright 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "ui/platform_window/x11/x11_window_ozone.h"
 
 #include <X11/Xlib.h>
 
 #include "base/bind.h"
 #include "ui/events/event.h"
@@ skipping 54 matching lines @@
   if (xwindow() == None)
     return false;
 
   // If there is a grab, capture events here.
   XID grabber = window_manager_->event_grabber();
   if (grabber != None)
     return grabber == xwindow();
 
   // TODO(kylechar): We may need to do something special for TouchEvents similar
   // to how DrmWindowHost handles them.
-  if (static_cast<Event*>(platform_event)->IsLocatedEvent()) {
-    const LocatedEvent* event =
-        static_cast<const LocatedEvent*>(platform_event);
-    return GetBounds().Contains(event->root_location());
+  auto* ewpe = static_cast<EventWithPlatformEvent*>(platform_event);
+  auto* xev = static_cast<XEvent*>(ewpe->platform_event);
+  DCHECK(xev);
+  if (!IsEventForXWindow(*xev))
+    return false;
+
+  Event* event = ewpe->event;
+  DCHECK(event);
+  if (event->IsLocatedEvent()) {
+    const LocatedEvent* located_event = static_cast<const LocatedEvent*>(event);
+    return GetBounds().Contains(located_event->root_location());
   }
 
   return true;
 }
 
 uint32_t X11WindowOzone::DispatchEvent(const PlatformEvent& platform_event) {
   // This is unfortunately needed otherwise events that depend on global state
   // (eg. double click) are broken.
+  auto* ewpe = static_cast<EventWithPlatformEvent*>(platform_event);
+  auto* event = static_cast<ui::Event*>(ewpe->event);

[fwang, 2017/04/03 09:36:57]

I guess you want DCHECK(event) here.

   DispatchEventFromNativeUiEvent(
-      platform_event, base::Bind(&PlatformWindowDelegate::DispatchEvent,
-                                 base::Unretained(delegate())));
+      event, base::Bind(&PlatformWindowDelegate::DispatchEvent,
+                        base::Unretained(delegate())));
   return POST_DISPATCH_STOP_PROPAGATION;
 }
 
 }  // namespace ui