Applying patch for Mohamed Mansour (reviewed by pkasting): http://codereview.chromium.org/16246

CRASH at Tab::OnMouseReleased

Some strange thing is happening that it crashes for view::HitTest, it can never
ENTER that function. It seems that the tab is being destroyed and as pkasting
stated on IRC: 
"Part of this may be because our retarded Views designs can't distinguish which
buttons are being held versus clicked in these sorts of cases (I filed a bug on
this about a year and a half ago, internally)"

When a tab has ended dragging (EndDrag), if something was being dragged and you
end it, it actually cleans the TabDelegate and assigns its value to 'freed
memory' which is 0xfeeefeee. Therefore it crashes while dragging, because the
object no longer exists. I couldn't do if (delegate_) cause that always returns
true since delegate has 0xfeeefeee. 

So I just changed the return type from void to bool for underlying EndDragImpl
and pumped it to tab.cc. That way, we can know if a tab is destroyed or not.

BUG=5819 (http://crbug.com/5819)

TEST=Dragging tabs around, closing while dragging, and closing tabs.


git-svn-id: svn://svn.chromium.org/chrome/trunk/src@7615 0039d316-1c4b-4281-b951-d872f2087c98

1 files changed, 3 insertions, 2 deletions

diff --git a/chrome/browser/views/tabs/tab.h b/chrome/browser/views/tabs/tab.h
index 17134e1..de3c981 100644
--- a/chrome/browser/views/tabs/tab.h
+++ b/chrome/browser/views/tabs/tab.h
@@ -66,8 +66,9 @@ class Tab : public TabRenderer,
     virtual void ContinueDrag(const views::MouseEvent& event) = 0;
 
     // Ends dragging a Tab. |canceled| is true if the drag was aborted in a way
-    // other than the user releasing the mouse.
-    virtual void EndDrag(bool canceled) = 0;
+    // other than the user releasing the mouse. Returns whether the tab has been
+    // destroyed.
+    virtual bool EndDrag(bool canceled) = 0;
   };
 
   explicit Tab(TabDelegate* delegate);