Fixes use after free during drag and drop.

chrome/browser/ui/views/tabs/tab_drag_controller_interactive_uitest.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/ui/views/tabs/tab_drag_controller_interactive_uitest.h"
 
 #include "ash/wm/property_util.h"
 #include "base/bind.h"
 #include "base/callback.h"
 #include "base/command_line.h"
 #include "base/run_loop.h"
 #include "base/strings/string_number_conversions.h"
 #include "chrome/browser/chrome_notification_types.h"
 #include "chrome/browser/ui/browser.h"
 #include "chrome/browser/ui/browser_commands.h"
 #include "chrome/browser/ui/browser_iterator.h"
 #include "chrome/browser/ui/browser_list.h"
 #include "chrome/browser/ui/host_desktop.h"
 #include "chrome/browser/ui/immersive_fullscreen_configuration.h"
 #include "chrome/browser/ui/tabs/tab_strip_model.h"
 #include "chrome/browser/ui/views/frame/browser_view.h"
+#include "chrome/browser/ui/views/frame/native_browser_frame_factory.h"
 #include "chrome/browser/ui/views/tabs/tab.h"
 #include "chrome/browser/ui/views/tabs/tab_drag_controller.h"
 #include "chrome/browser/ui/views/tabs/tab_strip.h"
 #include "chrome/common/chrome_switches.h"
 #include "chrome/test/base/in_process_browser_test.h"
 #include "chrome/test/base/interactive_test_utils.h"
 #include "chrome/test/base/ui_test_utils.h"
 #include "content/public/browser/notification_details.h"
 #include "content/public/browser/notification_observer.h"
 #include "content/public/browser/notification_service.h"
 #include "content/public/browser/notification_source.h"
 #include "content/public/browser/web_contents.h"
 #include "ui/base/test/ui_controls.h"
 #include "ui/gfx/screen.h"
 #include "ui/views/view.h"
 #include "ui/views/widget/widget.h"
 
+#if defined(USE_AURA) && !defined(OS_CHROMEOS)
+#include "chrome/browser/ui/views/frame/desktop_browser_frame_aura.h"
+#include "ui/views/widget/desktop_aura/desktop_native_widget_aura.h"
+#endif
+
 #if defined(USE_ASH)
 #include "ash/display/display_controller.h"
 #include "ash/display/display_manager.h"
 #include "ash/shell.h"
 #include "ash/test/cursor_manager_test_api.h"
 #include "ash/wm/coordinate_conversion.h"
 #include "ash/wm/window_util.h"
 #include "chrome/browser/ui/views/frame/immersive_mode_controller_ash.h"
 #include "ui/aura/client/screen_position_client.h"
 #include "ui/aura/root_window.h"
@@ skipping 183 matching lines @@
   }
 
  private:
   aura::RootWindow* root_window_;
 
   DISALLOW_COPY_AND_ASSIGN(ScreenEventGeneratorDelegate);
 };
 
 #endif
 
+#if defined(USE_AURA) && !defined(OS_CHROMEOS)
+
+// Following classes verify a crash scenario. Specifically on Windows when focus
+// changes it can trigger capture being lost. This was causing a crash in tab
+// dragging as it wasn't set up to handle this scenario. These classes
+// synthesize this scenario.
+
+// Allows making ClearNativeFocus() invoke ReleaseCapture().
+class TestDesktopBrowserFrameAura : public DesktopBrowserFrameAura {
+ public:
+  TestDesktopBrowserFrameAura(
+      BrowserFrame* browser_frame,
+      BrowserView* browser_view)
+      : DesktopBrowserFrameAura(browser_frame, browser_view),
+        release_capture_(false) {}
+  virtual ~TestDesktopBrowserFrameAura() {}
+
+  void ReleaseCaptureOnNextClear() {
+    release_capture_ = true;
+  }
+
+  virtual void ClearNativeFocus() OVERRIDE {
+    views::DesktopNativeWidgetAura::ClearNativeFocus();
+    if (release_capture_) {
+      release_capture_ = false;
+      GetWidget()->ReleaseCapture();
+    }
+  }
+
+ private:
+  // If true ReleaseCapture() is invoked in ClearNativeFocus().
+  bool release_capture_;
+
+  DISALLOW_COPY_AND_ASSIGN(TestDesktopBrowserFrameAura);
+};
+
+// Factory for creating a TestDesktopBrowserFrameAura.
+class TestNativeBrowserFrameFactory : public NativeBrowserFrameFactory {
+ public:
+  TestNativeBrowserFrameFactory() {}
+  virtual ~TestNativeBrowserFrameFactory() {}
+
+  virtual NativeBrowserFrame* Create(
+      BrowserFrame* browser_frame,
+      BrowserView* browser_view) OVERRIDE {
+    return new TestDesktopBrowserFrameAura(browser_frame, browser_view);
+  }
+
+ private:
+  DISALLOW_COPY_AND_ASSIGN(TestNativeBrowserFrameFactory);
+};
+
+class TabDragCaptureLostTest : public TabDragControllerTest {
+ public:
+  TabDragCaptureLostTest() {
+    NativeBrowserFrameFactory::Set(new TestNativeBrowserFrameFactory);
+  }
+
+ private:
+  DISALLOW_COPY_AND_ASSIGN(TabDragCaptureLostTest);
+};
+
+// See description above for details.
+IN_PROC_BROWSER_TEST_F(TabDragCaptureLostTest, ReleaseCaptureOnDrag) {
+  AddTabAndResetBrowser(browser());
+
+  TabStrip* tab_strip = GetTabStripForBrowser(browser());
+  gfx::Point tab_1_center(GetCenterInScreenCoordinates(tab_strip->tab_at(1)));
+  ASSERT_TRUE(ui_test_utils::SendMouseMoveSync(tab_1_center) &&
+              ui_test_utils::SendMouseEventsSync(
+                  ui_controls::LEFT, ui_controls::DOWN));
+  gfx::Point tab_0_center(GetCenterInScreenCoordinates(tab_strip->tab_at(0)));
+  TestDesktopBrowserFrameAura* frame =
+      static_cast<TestDesktopBrowserFrameAura*>(
+          BrowserView::GetBrowserViewForBrowser(browser())->GetWidget()->
+          native_widget_private());
+  // Invoke ReleaseCaptureOnDrag() so that when the drag happens and focus
+  // changes capture is released and the drag cancels.
+  frame->ReleaseCaptureOnNextClear();
+  ASSERT_TRUE(ui_test_utils::SendMouseMoveSync(tab_0_center));
+  EXPECT_FALSE(tab_strip->IsDragSessionActive());
+}
+
+#endif
+
 class DetachToBrowserTabDragControllerTest
     : public TabDragControllerTest,
       public ::testing::WithParamInterface<const char*> {
  public:
   DetachToBrowserTabDragControllerTest() {}
 
   virtual void SetUpCommandLine(CommandLine* command_line) OVERRIDE {
     command_line->AppendSwitch(switches::kTabBrowserDragging);
   }
 
@@ skipping 1534 matching lines @@
                         DifferentDeviceScaleFactorDisplayTabDragControllerTest,
                         ::testing::Values("mouse"));
 INSTANTIATE_TEST_CASE_P(TabDragging,
                         DetachToBrowserTabDragControllerTest,
                         ::testing::Values("mouse", "touch"));
 #else
 INSTANTIATE_TEST_CASE_P(TabDragging,
                         DetachToBrowserTabDragControllerTest,
                         ::testing::Values("mouse"));
 #endif