Fix use-after-free when browser is closed during a drop-drop on desktop Linux

ui/views/widget/desktop_aura/x11_whole_screen_move_loop.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "ui/views/widget/desktop_aura/x11_whole_screen_move_loop.h"
 
 #include <X11/keysym.h>
 #include <X11/Xlib.h>
 
 #include "base/bind.h"
@@ skipping 32 matching lines @@
       should_reset_mouse_flags_(false),
       grab_input_window_(None),
       grabbed_pointer_(false),
       canceled_(false),
       weak_factory_(this) {
 }
 
 X11WholeScreenMoveLoop::~X11WholeScreenMoveLoop() {}
 
 void X11WholeScreenMoveLoop::DispatchMouseMovement() {
-  if (!weak_factory_.HasWeakPtrs())
+  if (!last_motion_in_screen_)
     return;
-  weak_factory_.InvalidateWeakPtrs();
   delegate_->OnMouseMovement(last_motion_in_screen_->location(),
                              last_motion_in_screen_->flags(),
                              last_motion_in_screen_->time_stamp());
   last_motion_in_screen_.reset();
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // DesktopWindowTreeHostLinux, ui::PlatformEventDispatcher implementation:
 
 bool X11WholeScreenMoveLoop::CanDispatchEvent(const ui::PlatformEvent& event) {
   return in_move_loop_;
 }
 
 uint32_t X11WholeScreenMoveLoop::DispatchEvent(const ui::PlatformEvent& event) {
   // This method processes all events while the move loop is active.
   if (!in_move_loop_)
     return ui::POST_DISPATCH_PERFORM_DEFAULT;
 
   XEvent* xev = event;
   ui::EventType type = ui::EventTypeFromNative(xev);
   switch (type) {
     case ui::ET_MOUSE_MOVED:
-    case ui::ET_MOUSE_DRAGGED:
+    case ui::ET_MOUSE_DRAGGED: {
+      bool dispatch_mouse_event = !last_motion_in_screen_.get();
       last_motion_in_screen_.reset(
           static_cast<ui::MouseEvent*>(ui::EventFromNative(xev).release()));
       last_motion_in_screen_->set_location(
           ui::EventSystemLocationFromNative(xev));
-      if (!weak_factory_.HasWeakPtrs()) {
+      if (dispatch_mouse_event) {
         // Post a task to dispatch mouse movement event when control returns to
         // the message loop. This allows smoother dragging since the events are
         // dispatched without waiting for the drag widget updates.
         base::MessageLoopForUI::current()->PostTask(
             FROM_HERE,
             base::Bind(&X11WholeScreenMoveLoop::DispatchMouseMovement,
                        weak_factory_.GetWeakPtr()));
       }
       return ui::POST_DISPATCH_NONE;
+    }
     case ui::ET_MOUSE_RELEASED: {
       int button = (xev->type == ButtonRelease)
           ? xev->xbutton.button
           : ui::EventButtonFromNative(xev);
       if (button == Button1) {
         // Assume that drags are being done with the left mouse button. Only
         // break the drag if the left mouse button was released.
         DispatchMouseMovement();
         delegate_->OnMouseReleased();
 
@@ skipping 57 matching lines @@
 
   // We are handling a mouse drag outside of the aura::Window system. We must
   // manually make aura think that the mouse button is pressed so that we don't
   // draw extraneous tooltips.
   aura::Env* env = aura::Env::GetInstance();
   if (!env->IsMouseButtonDown()) {
     env->set_mouse_button_flags(ui::EF_LEFT_MOUSE_BUTTON);
     should_reset_mouse_flags_ = true;
   }
 
+  base::WeakPtr<X11WholeScreenMoveLoop> alive(weak_factory_.GetWeakPtr());
+
   in_move_loop_ = true;
   canceled_ = false;
   base::MessageLoopForUI* loop = base::MessageLoopForUI::current();
   base::MessageLoop::ScopedNestableTaskAllower allow_nested(loop);
   base::RunLoop run_loop;
   quit_closure_ = run_loop.QuitClosure();
   run_loop.Run();
+
+  if (!alive)
+    return false;
+
   nested_dispatcher_ = old_dispatcher.Pass();
   return !canceled_;
 }
 
 void X11WholeScreenMoveLoop::UpdateCursor(gfx::NativeCursor cursor) {
   if (in_move_loop_) {
     // We cannot call GrabPointer() because we do not want to change the
     // "owner_events" property of the active pointer grab.
     XChangeActivePointerGrab(
         gfx::GetXDisplay(),
@@ skipping 88 matching lines @@
                                 DefaultRootWindow(display),
                                 -100, -100, 10, 10,
                                 0, CopyFromParent, InputOnly, CopyFromParent,
                                 attribute_mask, &swa);
   XMapRaised(display, window);
   ui::X11EventSource::GetInstance()->BlockUntilWindowMapped(window);
   return window;
 }
 
 }  // namespace views