Fixes possible crash during tab dragging. The code was invoking

InitWindowCreatePoint when making a tab pinned, which is only save to
invoke when the drag starts.

BUG=27329
TEST=make sure no regressions in tab dragging.

Review URL: http://codereview.chromium.org/391006

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@31663 0039d316-1c4b-4281-b951-d872f2087c98

2 files changed, 18 insertions, 8 deletions

diff --git a/chrome/browser/views/tabs/dragged_tab_controller.cc b/chrome/browser/views/tabs/dragged_tab_controller.cc
index 4290c8b..f91a3f1 100644
--- a/chrome/browser/views/tabs/dragged_tab_controller.cc
+++ b/chrome/browser/views/tabs/dragged_tab_controller.cc
@@ -501,7 +501,6 @@ void DraggedTabController::DidProcessEvent(GdkEvent* event) {
 // DraggedTabController, private:
 
 void DraggedTabController::InitWindowCreatePoint() {
-  window_create_point_.SetPoint(mouse_offset_.x(), mouse_offset_.y());
   // window_create_point_ is only used in CompleteDrag() (through
   // GetWindowCreatePoint() to get the start point of the docked window) when
   // the attached_tabstrip_ is NULL and all the window's related bound
@@ -510,7 +509,14 @@ void DraggedTabController::InitWindowCreatePoint() {
   // the window_create_point_ is not in the correct coordinate system. Please
   // refer to http://crbug.com/6223 comment #15 for detailed information.
   Tab* first_tab = source_tabstrip_->GetTabAt(0);
-  views::View::ConvertPointToWidget(first_tab, &window_create_point_);
+  views::View::ConvertPointToWidget(first_tab, &first_source_tab_point_);
+  UpdateWindowCreatePoint();
+}
+
+void DraggedTabController::UpdateWindowCreatePoint() {
+  // See comments in InitWindowCreatePoint for details on this.
+  window_create_point_ = first_source_tab_point_;
+  window_create_point_.Offset(mouse_offset_.x(), mouse_offset_.y());
 }
 
 gfx::Point DraggedTabController::GetWindowCreatePoint() const {
@@ -726,7 +732,7 @@ void DraggedTabController::MakeDraggedTabPinned(int tab_index) {
   // Reset the hotspot (mouse_offset_) for the dragged tab. Otherwise the
   // dragged tab may be nowhere near the mouse.
   mouse_offset_.set_x(Tab::GetPinnedWidth() / 2 - 1);
-  InitWindowCreatePoint();
+  UpdateWindowCreatePoint();
   view_->set_mouse_tab_offset(mouse_offset_);
 
   // Resize the dragged tab.
diff --git a/chrome/browser/views/tabs/dragged_tab_controller.h b/chrome/browser/views/tabs/dragged_tab_controller.h
index 6b0c637..d4e33c5 100644
--- a/chrome/browser/views/tabs/dragged_tab_controller.h
+++ b/chrome/browser/views/tabs/dragged_tab_controller.h
@@ -68,12 +68,8 @@ class DraggedTabController : public TabContentsDelegate,
   // Returns true if the specified Tab matches the Tab being dragged.
   bool IsDragSourceTab(Tab* tab) const;
 
-
-
   TabContents* dragged_contents() { return dragged_contents_; }
 
-
-
  private:
   class DockDisplayer;
   friend class DockDisplayer;
@@ -127,9 +123,13 @@ class DraggedTabController : public TabContentsDelegate,
 #endif
 
   // Initialize the offset used to calculate the position to create windows
-  // in |GetWindowCreatePoint|.
+  // in |GetWindowCreatePoint|. This should only be invoked from
+  // |CaptureDragInfo|.
   void InitWindowCreatePoint();
 
+  // Updates the window create point from |mouse_offset_|.
+  void UpdateWindowCreatePoint();
+
   // Returns the point where a detached window should be created given the
   // current mouse position.
   gfx::Point GetWindowCreatePoint() const;
@@ -312,6 +312,10 @@ class DraggedTabController : public TabContentsDelegate,
   // attached TabStrip from the top left of the window.
   gfx::Point window_create_point_;
 
+  // Location of the first tab in the source tabstrip in screen coordinates.
+  // This is used to calculate window_create_point_.
+  gfx::Point first_source_tab_point_;
+
   // The bounds of the browser window before the last Tab was detached. When
   // the last Tab is detached, rather than destroying the frame (which would
   // abort the drag session), the frame is moved off-screen. If the drag is