Fixing a "use after free".

ui/aura/window_event_dispatcher_unittest.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "ui/aura/window_event_dispatcher.h"
 
 #include <vector>
 
 #include "base/bind.h"
 #include "base/run_loop.h"
@@ skipping 2016 matching lines @@
             recorder.touch_locations()[0].ToString());
   EXPECT_EQ(gfx::Point(-40, 10).ToString(),
             recorder.touch_locations()[1].ToString());
 }
 
 class SelfDestructDelegate : public test::TestWindowDelegate {
  public:
   SelfDestructDelegate() {}
   virtual ~SelfDestructDelegate() {}
 
   virtual void OnMouseEvent(ui::MouseEvent* event) override {

[sky, 2014/10/21 20:08:10]

When is a mouse event generated by the code you have that triggers destruction?
More generically, does your test fail without the patch?

[mfomitchev, 2014/10/21 20:35:33]

Yes, the test fails without the patch. The mouse event is the
ET_MOUSE_CAPTURE_CHANGED generated in WindowEventDispatcher::UpdateCapture
called from line 2100 of the test.

     window_.reset();
   }
 
   void set_window(scoped_ptr<aura::Window> window) {
     window_ = window.Pass();
   }
   bool has_window() const { return !!window_.get(); }
 
  private:
   scoped_ptr<aura::Window> window_;
@@ skipping 24 matching lines @@
       &delegate, 1, gfx::Rect(50, 50, 100, 100), root_window()));
   delegate.set_window(window.Pass());
   EXPECT_TRUE(delegate.has_window());
 
   generator.MoveMouseTo(100, 100);
   EXPECT_FALSE(delegate.has_window());
   EXPECT_EQ("100,100",
             Env::GetInstance()->last_mouse_location().ToString());
 }
 
+// Tests that the window which has capture can get destroyed as a result of
+// ui::ET_MOUSE_CAPTURE_CHANGED event dispatched in
+// WindowEventDispatcher::UpdateCapture without causing a "use after free".
+TEST_F(WindowEventDispatcherTest, DestroyWindowOnCaptureChanged) {
+  SelfDestructDelegate delegate;
+  scoped_ptr<aura::Window> window_first(CreateTestWindowWithDelegate(
+      &delegate, 1, gfx::Rect(20, 10, 10, 20), root_window()));
+  Window* window_first_raw = window_first.get();
+  window_first->Show();
+  window_first->SetCapture();
+  delegate.set_window(window_first.Pass());
+  EXPECT_TRUE(delegate.has_window());
+
+  scoped_ptr<aura::Window> window_second(
+      test::CreateTestWindowWithId(2, root_window()));
+  window_second->Show();
+
+  client::CaptureDelegate* capture_delegate = host()->dispatcher();
+  capture_delegate->UpdateCapture(window_first_raw, window_second.get());
+  EXPECT_FALSE(delegate.has_window());
+}
+
 class StaticFocusClient : public client::FocusClient {
  public:
   explicit StaticFocusClient(Window* focused)
       : focused_(focused) {}
   virtual ~StaticFocusClient() {}
 
  private:
   // client::FocusClient:
   virtual void AddObserver(client::FocusChangeObserver* observer) override {}
   virtual void RemoveObserver(client::FocusChangeObserver* observer) override {}
@@ skipping 268 matching lines @@
   ASSERT_EQ(1u, recorder.touch_locations().size());
   EXPECT_EQ(gfx::Point(kX - kWindowOffset, kY - kWindowOffset).ToString(),
             recorder.touch_locations()[0].ToString());
 
   ASSERT_EQ(2u, recorder.gesture_locations().size());
   EXPECT_EQ(gfx::Point(kX - kWindowOffset, kY - kWindowOffset).ToString(),
             recorder.gesture_locations()[0].ToString());
 }
 
 }  // namespace aura