Fixing a "use after free".

ui/aura/window_event_dispatcher.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "ui/aura/window_event_dispatcher.h"
 
 #include "base/bind.h"
 #include "base/debug/trace_event.h"
 #include "base/logging.h"
 #include "base/message_loop/message_loop.h"
@@ skipping 360 matching lines @@
   if (mouse_moved_handler_ && !window()->Contains(mouse_moved_handler_))
     mouse_moved_handler_ = NULL;
 
   if (old_capture && old_capture->GetRootWindow() == window() &&
       old_capture->delegate()) {
     // Send a capture changed event with bogus location data.
     ui::MouseEvent event(ui::ET_MOUSE_CAPTURE_CHANGED, gfx::Point(),
                          gfx::Point(), 0, 0);
 
     DispatchDetails details = DispatchEvent(old_capture, &event);
-    if (details.dispatcher_destroyed)
+    if (details.dispatcher_destroyed || details.target_destroyed)

[sky, 2014/10/21 02:45:32]

If target_destroyed is true, isn't the only thing we want to avoid calling
OnCaptureLost? In other words, shouldn't the if be around 384?

[mfomitchev, 2014/10/21 20:02:03]

Done.

       return;
 
     old_capture->delegate()->OnCaptureLost();
   }
 
   if (new_capture) {
     // Make all subsequent mouse events go to the capture window. We shouldn't
     // need to send an event here as OnCaptureLost() should take care of that.
     if (mouse_moved_handler_ || Env::GetInstance()->IsMouseButtonDown())
       mouse_moved_handler_ = new_capture;
@@ skipping 505 matching lines @@
 
     default:
       NOTREACHED();
       break;
   }
 
   PreDispatchLocatedEvent(target, event);
 }
 
 }  // namespace aura