Fix for a crasher in the browser seen while dispatching mouse enter or mouse exit messages via the …

ui/views/widget/root_view.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "ui/views/widget/root_view.h"
 
 #include <algorithm>
 
 #include "base/logging.h"
 #include "base/message_loop/message_loop.h"
@@ skipping 475 matching lines @@
       if (mouse_move_handler_ != NULL &&
           (!mouse_move_handler_->notify_enter_exit_on_child() ||
            !mouse_move_handler_->Contains(v))) {
         MouseEnterExitEvent exit(event, ui::ET_MOUSE_EXITED);
         exit.ConvertLocationToTarget(static_cast<View*>(this),
                                      mouse_move_handler_);
         ui::EventDispatchDetails dispatch_details =
             DispatchEvent(mouse_move_handler_, &exit);
         if (dispatch_details.dispatcher_destroyed)
           return;
-        NotifyEnterExitOfDescendant(event, ui::ET_MOUSE_EXITED,
-            mouse_move_handler_, v);
+        // The mouse_move_handler_ could get reset to NULL if we end up in a
+        // nested DispatchEvent callstack.
+        if (mouse_move_handler_) {

[sadrul, 2015/03/17 16:09:14]

I think checking for !dispatch_details.target_destroyed would also work? That
would probably be clearer?
  if (!dispatch_details.target_destroyed) {
    CHECK(mouse_move_handler_);
    ....
  }

[ananta, 2015/03/18 01:11:06]

Done.

+          NotifyEnterExitOfDescendant(event, ui::ET_MOUSE_EXITED,
+              mouse_move_handler_, v);
+        }
       }
       View* old_handler = mouse_move_handler_;
       mouse_move_handler_ = v;
       if (!mouse_move_handler_->notify_enter_exit_on_child() ||
           !mouse_move_handler_->Contains(old_handler)) {
         MouseEnterExitEvent entered(event, ui::ET_MOUSE_ENTERED);
         entered.ConvertLocationToTarget(static_cast<View*>(this),
                                         mouse_move_handler_);
         ui::EventDispatchDetails dispatch_details =
             DispatchEvent(mouse_move_handler_, &entered);
         if (dispatch_details.dispatcher_destroyed)
           return;
-        NotifyEnterExitOfDescendant(event, ui::ET_MOUSE_ENTERED,
-            mouse_move_handler_, old_handler);
+        // The mouse_move_handler_ could get reset to NULL if we end up in a
+        // nested DispatchEvent callstack.
+        if (mouse_move_handler_) {
+          NotifyEnterExitOfDescendant(event, ui::ET_MOUSE_ENTERED,
+              mouse_move_handler_, old_handler);
+        }
       }
     }
     ui::MouseEvent moved_event(event, static_cast<View*>(this),
                                mouse_move_handler_);
     mouse_move_handler_->OnMouseMoved(moved_event);
     // TODO(tdanderson): It may be possible to avoid setting the cursor twice
     //                   (once here and once from CompoundEventFilter) on a
     //                   mousemove. See crbug.com/351469.
     if (!(moved_event.flags() & ui::EF_IS_NON_CLIENT))
       widget_->SetCursor(mouse_move_handler_->GetCursor(moved_event));
   } else if (mouse_move_handler_ != NULL) {
     MouseEnterExitEvent exited(event, ui::ET_MOUSE_EXITED);
     ui::EventDispatchDetails dispatch_details =
         DispatchEvent(mouse_move_handler_, &exited);
     if (dispatch_details.dispatcher_destroyed)
       return;
-    NotifyEnterExitOfDescendant(event, ui::ET_MOUSE_EXITED,
-        mouse_move_handler_, v);
+    // The mouse_move_handler_ could get reset to NULL if we end up in a nested
+    // DispatchEvent callstack.
+    if (mouse_move_handler_) {
+      NotifyEnterExitOfDescendant(event, ui::ET_MOUSE_EXITED,
+          mouse_move_handler_, v);
+    }
     // On Aura the non-client area extends slightly outside the root view for
     // some windows.  Let the non-client cursor handling code set the cursor
     // as we do above.
     if (!(event.flags() & ui::EF_IS_NON_CLIENT))
       widget_->SetCursor(gfx::kNullCursor);
     mouse_move_handler_ = NULL;
   }
 }
 
 void RootView::OnMouseExited(const ui::MouseEvent& event) {
   if (mouse_move_handler_ != NULL) {
     MouseEnterExitEvent exited(event, ui::ET_MOUSE_EXITED);
     ui::EventDispatchDetails dispatch_details =
         DispatchEvent(mouse_move_handler_, &exited);
     if (dispatch_details.dispatcher_destroyed)
       return;
-    NotifyEnterExitOfDescendant(event, ui::ET_MOUSE_EXITED,
-        mouse_move_handler_, NULL);
+    // The mouse_move_handler_ could get reset to NULL if we end up in a nested
+    // DispatchEvent callstack.
+    if (mouse_move_handler_) {
+      NotifyEnterExitOfDescendant(event, ui::ET_MOUSE_EXITED,
+          mouse_move_handler_, NULL);
+    }
     mouse_move_handler_ = NULL;
   }
 }
 
 bool RootView::OnMouseWheel(const ui::MouseWheelEvent& event) {
   for (View* v = GetEventHandlerForPoint(event.location());
        v && v != this && !event.handled(); v = v->parent()) {
     ui::EventDispatchDetails dispatch_details =
         DispatchEvent(v, const_cast<ui::MouseWheelEvent*>(&event));
     if (dispatch_details.dispatcher_destroyed ||
@@ skipping 92 matching lines @@
 void RootView::SetMouseLocationAndFlags(const ui::MouseEvent& event) {
   last_mouse_event_flags_ = event.flags();
   last_mouse_event_x_ = event.x();
   last_mouse_event_y_ = event.y();
 }
 
 void RootView::NotifyEnterExitOfDescendant(const ui::MouseEvent& event,
                                            ui::EventType type,
                                            View* view,
                                            View* sibling) {
+  CHECK(view);
   for (View* p = view->parent(); p; p = p->parent()) {
     if (!p->notify_enter_exit_on_child())
       continue;
     if (sibling && p->Contains(sibling))
       break;
     // It is necessary to recreate the notify-event for each dispatch, since one
     // of the callbacks can mark the event as handled, and that would cause
     // incorrect event dispatch.
     MouseEnterExitEvent notify_event(event, type);
     ui::EventDispatchDetails dispatch_details = DispatchEvent(p, &notify_event);
@@ skipping 55 matching lines @@
 
 #ifndef NDEBUG
   DCHECK(!event_dispatch_target_ || Contains(event_dispatch_target_));
 #endif
 
   return details;
 }
 
 }  // namespace internal
 }  // namespace views