Fixing a "use after free".

ui/views/touchui/touch_selection_controller_impl.cc

 // Copyright (c) 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "ui/views/touchui/touch_selection_controller_impl.h"
 
 #include "base/time/time.h"
 #include "ui/aura/client/cursor_client.h"
 #include "ui/aura/env.h"
 #include "ui/aura/window.h"
@@ skipping 204 matching lines @@
             kSelectionHandleVerticalDragOffset;
         break;
       case ui::ET_GESTURE_SCROLL_UPDATE: {
         gfx::Point drag_pos(event->location().x(),
             event->location().y() - drag_offset_);
         controller_->SelectionHandleDragged(drag_pos);
         break;
       }
       case ui::ET_GESTURE_SCROLL_END:
       case ui::ET_SCROLL_FLING_START:
+        controller_->SetDraggingHandle(NULL);
+        // ReleaseCapture() is potentially destructive and should be done at
+        // the very end.
         widget_->ReleaseCapture();
-        controller_->SetDraggingHandle(NULL);
         break;
       default:
         break;
     }
   }
 
   virtual gfx::Size GetPreferredSize() const override {
     gfx::Size image_size = GetHandleImageSize();
     return gfx::Size(image_size.width() + 2 * kSelectionHandleHorizPadding,
                      image_size.height() + selection_rect_.height() +
@@ skipping 388 matching lines @@
 
 bool TouchSelectionControllerImpl::IsSelectionHandle2Visible() {
   return selection_handle_2_->IsWidgetVisible();
 }
 
 bool TouchSelectionControllerImpl::IsCursorHandleVisible() {
   return cursor_handle_->IsWidgetVisible();
 }
 
 }  // namespace views