Fix for a crasher in the browser seen while dispatching mouse enter or mouse exit messages via the …

ui/views/widget/root_view.cc

Index: ui/views/widget/root_view.cc
diff --git a/ui/views/widget/root_view.cc b/ui/views/widget/root_view.cc
index 6e45f3566e465e11e7c426ff4ec06ba5a926c60b..7b235576f04b4b07dfa5727cce303702ceca5e08 100644
--- a/ui/views/widget/root_view.cc
+++ b/ui/views/widget/root_view.cc
@@ -493,8 +493,12 @@ void RootView::OnMouseMoved(const ui::MouseEvent& event) {
             DispatchEvent(mouse_move_handler_, &exit);
         if (dispatch_details.dispatcher_destroyed)
           return;
-        NotifyEnterExitOfDescendant(event, ui::ET_MOUSE_EXITED,
-            mouse_move_handler_, v);
+        // The mouse_move_handler_ could get reset to NULL if we end up in a
+        // nested DispatchEvent callstack.
+        if (mouse_move_handler_) {

[sadrul, 2015/03/17 16:09:14]

I think checking for !dispatch_details.target_destroyed would also work? That
would probably be clearer?
  if (!dispatch_details.target_destroyed) {
    CHECK(mouse_move_handler_);
    ....
  }

[ananta, 2015/03/18 01:11:06]

Done.

+          NotifyEnterExitOfDescendant(event, ui::ET_MOUSE_EXITED,
+              mouse_move_handler_, v);
+        }
       }
       View* old_handler = mouse_move_handler_;
       mouse_move_handler_ = v;
@@ -507,8 +511,12 @@ void RootView::OnMouseMoved(const ui::MouseEvent& event) {
             DispatchEvent(mouse_move_handler_, &entered);
         if (dispatch_details.dispatcher_destroyed)
           return;
-        NotifyEnterExitOfDescendant(event, ui::ET_MOUSE_ENTERED,
-            mouse_move_handler_, old_handler);
+        // The mouse_move_handler_ could get reset to NULL if we end up in a
+        // nested DispatchEvent callstack.
+        if (mouse_move_handler_) {
+          NotifyEnterExitOfDescendant(event, ui::ET_MOUSE_ENTERED,
+              mouse_move_handler_, old_handler);
+        }
       }
     }
     ui::MouseEvent moved_event(event, static_cast<View*>(this),
@@ -525,8 +533,12 @@ void RootView::OnMouseMoved(const ui::MouseEvent& event) {
         DispatchEvent(mouse_move_handler_, &exited);
     if (dispatch_details.dispatcher_destroyed)
       return;
-    NotifyEnterExitOfDescendant(event, ui::ET_MOUSE_EXITED,
-        mouse_move_handler_, v);
+    // The mouse_move_handler_ could get reset to NULL if we end up in a nested
+    // DispatchEvent callstack.
+    if (mouse_move_handler_) {
+      NotifyEnterExitOfDescendant(event, ui::ET_MOUSE_EXITED,
+          mouse_move_handler_, v);
+    }
     // On Aura the non-client area extends slightly outside the root view for
     // some windows.  Let the non-client cursor handling code set the cursor
     // as we do above.
@@ -543,8 +555,12 @@ void RootView::OnMouseExited(const ui::MouseEvent& event) {
         DispatchEvent(mouse_move_handler_, &exited);
     if (dispatch_details.dispatcher_destroyed)
       return;
-    NotifyEnterExitOfDescendant(event, ui::ET_MOUSE_EXITED,
-        mouse_move_handler_, NULL);
+    // The mouse_move_handler_ could get reset to NULL if we end up in a nested
+    // DispatchEvent callstack.
+    if (mouse_move_handler_) {
+      NotifyEnterExitOfDescendant(event, ui::ET_MOUSE_EXITED,
+          mouse_move_handler_, NULL);
+    }
     mouse_move_handler_ = NULL;
   }
 }
@@ -657,6 +673,7 @@ void RootView::NotifyEnterExitOfDescendant(const ui::MouseEvent& event,
                                            ui::EventType type,
                                            View* view,
                                            View* sibling) {
+  CHECK(view);
   for (View* p = view->parent(); p; p = p->parent()) {
     if (!p->notify_enter_exit_on_child())
       continue;