app_list: Fix possible out of bounds index.

ui/app_list/views/apps_grid_view.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "ui/app_list/views/apps_grid_view.h"
 
 #include <algorithm>
 #include <set>
 #include <string>
 
@@ skipping 330 matching lines @@
       item_list_(NULL),
       delegate_(delegate),
       folder_delegate_(NULL),
       pagination_model_(pagination_model),
       page_switcher_view_(new PageSwitcher(pagination_model)),
       cols_(0),
       rows_per_page_(0),
       selected_view_(NULL),
       drag_view_(NULL),
       drag_start_page_(-1),
+#if defined(OS_WIN)
+      use_synchronous_drag_(true),
+#endif
       drag_pointer_(NONE),
       drop_attempt_(DROP_FOR_NONE),
       drag_and_drop_host_(NULL),
       forward_events_to_drag_and_drop_host_(false),
       page_flip_target_(-1),
       page_flip_delay_in_ms_(kPageFlipDelayInMs),
       bounds_animator_(this),
       activated_folder_item_view_(NULL),
       dragging_for_reparent_item_(false) {
   SetPaintToLayer(true);
@@ skipping 34 matching lines @@
 void AppsGridView::ResetForShowApps() {
   activated_folder_item_view_ = NULL;
   ClearDragState();
   layer()->SetOpacity(1.0f);
   SetVisible(true);
   // Set all views to visible in case they weren't made visible again by an
   // incomplete animation.
   for (int i = 0; i < view_model_.view_size(); ++i) {
     view_model_.view_at(i)->SetVisible(true);
   }
+  CHECK_EQ(item_list_->item_count(),
+           static_cast<size_t>(view_model_.view_size()));
 }
 
 void AppsGridView::SetModel(AppListModel* model) {
   if (model_)
     model_->RemoveObserver(this);
 
   model_ = model;
   if (model_)
     model_->AddObserver(this);
 
@@ skipping 55 matching lines @@
   drag_view_ = view;
   drag_view_init_index_ = GetIndexOfView(drag_view_);
   drag_view_offset_ = event.location();
   drag_start_page_ = pagination_model_->selected_page();
   ExtractDragLocation(event, &drag_start_grid_view_);
   drag_view_start_ = gfx::Point(drag_view_->x(), drag_view_->y());
 }
 
 void AppsGridView::StartSettingUpSynchronousDrag() {
 #if defined(OS_WIN)
-  if (!delegate_)
+  if (!delegate_ || !use_synchronous_drag_)
     return;
 
   // Folders can't be integrated with the OS.
   if (IsFolderItem(drag_view_->item()))
     return;
 
   // Favor the drag and drop host over native win32 drag. For the Win8/ash
   // launcher we want to have ashes drag and drop over win32's.
   if (drag_and_drop_host_)
     return;
@@ skipping 314 matching lines @@
   drop_attempt_ = DROP_FOR_NONE;
   drag_pointer_ = NONE;
   drop_target_ = Index();
   drag_start_grid_view_ = gfx::Point();
   drag_start_page_ = -1;
   drag_view_offset_ = gfx::Point();
 
   if (drag_view_) {
     drag_view_->OnDragEnded();
     if (IsDraggingForReparentInRootLevelGridView()) {
-      DeleteItemViewAtIndex(view_model_.GetIndexOfView(drag_view_));
+      const int drag_view_index = view_model_.GetIndexOfView(drag_view_);
+      CHECK_EQ(view_model_.view_size() - 1, drag_view_index);
+      DeleteItemViewAtIndex(drag_view_index);
     }
   }
   drag_view_ = NULL;
   dragging_for_reparent_item_ = false;
 }
 
 void AppsGridView::SetDragViewVisible(bool visible) {
   DCHECK(drag_view_);
   SetViewHidden(drag_view_, !visible, true);
 }
@@ skipping 106 matching lines @@
   bool handled = false;
   if (selected_view_)
     handled = selected_view_->OnKeyReleased(event);
 
   return handled;
 }
 
 void AppsGridView::ViewHierarchyChanged(
     const ViewHierarchyChangedDetails& details) {
   if (!details.is_add && details.parent == this) {
+    // The view being delete should not have reference in |view_model_|.
+    CHECK_EQ(-1, view_model_.GetIndexOfView(details.child));
+
     if (selected_view_ == details.child)
       selected_view_ = NULL;
     if (activated_folder_item_view_ == details.child)
       activated_folder_item_view_ = NULL;
 
     if (drag_view_ == details.child)
       EndDrag(true);
 
     bounds_animator_.StopAnimatingView(details.child);
   }
@@ skipping 734 matching lines @@
                                           const Index& target) {
   item_list_->RemoveObserver(this);
   model_->RemoveObserver(this);
 
   AppListItem* reparent_item = static_cast<AppListItemView*>(item_view)->item();
   DCHECK(reparent_item->IsInFolder());
   const std::string source_folder_id = reparent_item->folder_id();
   AppListFolderItem* source_folder =
       static_cast<AppListFolderItem*>(item_list_->FindItem(source_folder_id));
 
+  int target_model_index = GetModelIndexFromIndex(target);
+
   // Remove the source folder view if there is only 1 item in it, since the
   // source folder will be deleted after its only child item removed from it.
-  if (source_folder->ChildItemCount() == 1u)
-    DeleteItemViewAtIndex(
-        view_model_.GetIndexOfView(activated_folder_item_view()));
+  if (source_folder->ChildItemCount() == 1u) {
+    const int deleted_folder_index =
+        view_model_.GetIndexOfView(activated_folder_item_view());
+    DeleteItemViewAtIndex(deleted_folder_index);
+
+    // Adjust |target_model_index| if it is beyond the deleted folder index.
+    if (target_model_index > deleted_folder_index)
+      --target_model_index;
+  }
 
   // Move the item from its parent folder to top level item list.
   // Must move to target_model_index, the location we expect the target item
   // to be, not the item location we want to insert before.
-  int target_model_index = GetModelIndexFromIndex(target);
   int current_model_index = view_model_.GetIndexOfView(item_view);
   syncer::StringOrdinal target_position;
   if (target_model_index < static_cast<int>(item_list_->item_count()))
     target_position = item_list_->item_at(target_model_index)->position();
   model_->MoveItemToFolderAt(reparent_item, "", target_position);
   view_model_.Move(current_model_index, target_model_index);
 
   RemoveLastItemFromReparentItemFolderIfNecessary(source_folder_id);
 
   item_list_->AddObserver(this);
@@ skipping 81 matching lines @@
   // Delete view associated with the folder item to be removed.
   DeleteItemViewAtIndex(
       view_model_.GetIndexOfView(activated_folder_item_view()));
 
   // Now make the data change to remove the folder item in model.
   AppListItem* last_item = source_folder->item_list()->item_at(0);
   model_->MoveItemToFolderAt(last_item, "", source_folder->position());
 
   // Create a new item view for the last item in folder.
   size_t last_item_index;
-  item_list_->FindItemIndex(last_item->id(), &last_item_index);
+  if (!item_list_->FindItemIndex(last_item->id(), &last_item_index) ||
+      last_item_index > static_cast<size_t>(view_model_.view_size())) {
+    NOTREACHED();
+    return;
+  }
   views::View* last_item_view = CreateViewForItemAtIndex(last_item_index);
   view_model_.Add(last_item_view, last_item_index);
   AddChildView(last_item_view);
 }
 
 void AppsGridView::CancelFolderItemReparent(AppListItemView* drag_item_view) {
   // The icon of the dragged item must target to its final ideal bounds after
   // the animation completes.
   CalculateIdealBounds();
 
@@ skipping 191 matching lines @@
   pt = drag_view_->bounds().bottom_right();
   CalculateNearestTileForVertex(pt, &nearest_tile, &d_min);
 
   const int d_folder_dropping =
       kFolderDroppingCircleRadius + kPreferredIconDimension / 2;
   const int d_reorder =
       kReorderDroppingCircleRadius + kPreferredIconDimension / 2;
 
   // If user drags an item across pages to the last page, and targets it
   // to the last empty slot on it, push the last item for re-ordering.
-  if (IsFirstEmptySlot(nearest_tile) && d_min < d_reorder) {
+  if (IsLastPossibleDropTarget(nearest_tile) && d_min < d_reorder) {
     drop_attempt_ = DROP_FOR_REORDER;
     nearest_tile.slot = nearest_tile.slot - 1;
     return nearest_tile;
   }
 
   if (IsValidIndex(nearest_tile)) {
     if (d_min < d_folder_dropping) {
       views::View* target_view = GetViewAtSlotOnCurrentPage(nearest_tile.slot);
       if (target_view &&
           !IsFolderItem(static_cast<AppListItemView*>(drag_view_)->item())) {
@@ skipping 82 matching lines @@
   gfx::Rect grid_rect(gfx::Size(tile_size.width() * cols_,
                                 tile_size.height() * rows_per_page_));
   grid_rect.Intersect(bounds);
   gfx::Rect tile_rect(
       gfx::Point(grid_rect.x() + col * tile_size.width(),
                  grid_rect.y() + row * tile_size.height()),
       tile_size);
   return tile_rect;
 }
 
-bool AppsGridView::IsFirstEmptySlot(const Index& index) const {
-  // Don't count the hidden drag_view_ created from the item_dragged out of a
-  // folder during re-parenting into the total number of views that are visible
-  // on all grid view pages.
-  int total_views = IsDraggingForReparentInRootLevelGridView()
-                        ? view_model_.view_size() - 1
-                        : view_model_.view_size();
-  int last_possible_slot = (total_views - 1) % tiles_per_page();
+bool AppsGridView::IsLastPossibleDropTarget(const Index& index) const {
+  int last_possible_slot = view_model_.view_size() % tiles_per_page();
   return (index.page == pagination_model_->total_pages() - 1 &&
           index.slot == last_possible_slot + 1);
 }
 
 views::View* AppsGridView::GetViewAtSlotOnCurrentPage(int slot) {
   if (slot < 0)
     return NULL;
 
   // Calculate the original bound of the tile at |index|.
   int row = slot / cols_;
@@ skipping 11 matching lines @@
 void AppsGridView::SetAsFolderDroppingTarget(const Index& target_index,
                                              bool is_target_folder) {
   AppListItemView* target_view =
       static_cast<AppListItemView*>(
           GetViewAtSlotOnCurrentPage(target_index.slot));
   if (target_view)
     target_view->SetAsAttemptedFolderTarget(is_target_folder);
 }
 
 }  // namespace app_list