diff options
| author | varkha <varkha@chromium.org> | 2015-11-20 10:40:00 -0800 |
|---|---|---|
| committer | Commit bot <commit-bot@chromium.org> | 2015-11-20 18:40:54 +0000 |
| commit | 11fc14387a72edf5df46e9e8bc1ba34a53288c62 (patch) | |
| tree | 1426559c20ccb0137ceef0b152d6990b7d472a3c /ui/aura | |
| parent | 36ec2552c771256b5dc0ce5069ef15c6657a6cd3 (diff) | |
| download | chromium_src-11fc14387a72edf5df46e9e8bc1ba34a53288c62.zip chromium_src-11fc14387a72edf5df46e9e8bc1ba34a53288c62.tar.gz chromium_src-11fc14387a72edf5df46e9e8bc1ba34a53288c62.tar.bz2 | |
Fixes crash when clicking while touching shelf in overview mode
Failure description:
Clicking an overview window while touch-dragging a shelf sets a capture
on an overview mode window. This has a side effect of canceling a touch
gesture which changes focus which cancels overview mode which destroys
the overview window while a capture is being set on it.
CaptureController::SetCapture then continues and exits after having set
capture to a window that no longer exists. This deleted window then gets
all mouse events and the first such event (mouse up) kills chrome.
The fix attempts to remember if SetCapture was invoked and if so keeps
track of ReleaseCapture being called while inside SetCapture. When this
situation is detected SetCapture avoids forcing capture and that
prevents the crash.
Additionally overview mode windows need to release capture before being
destroyed.
BUG=530992
Review URL: https://codereview.chromium.org/1429963004
Cr-Commit-Position: refs/heads/master@{#360865}
Diffstat (limited to 'ui/aura')
| -rw-r--r-- | ui/aura/window_targeter.cc | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/ui/aura/window_targeter.cc b/ui/aura/window_targeter.cc index df4e064..4b72051 100644 --- a/ui/aura/window_targeter.cc +++ b/ui/aura/window_targeter.cc @@ -71,6 +71,7 @@ ui::EventTarget* WindowTargeter::FindTargetForEvent(ui::EventTarget* root, // |window|. So do not allow dispatching from here. Instead, dispatch the // event through the WindowEventDispatcher that owns |target|. Window* new_root = target->GetRootWindow(); + DCHECK(new_root); if (event->IsLocatedEvent()) { // The event has been transformed to be in |target|'s coordinate system. // But dispatching the event through the EventProcessor requires the event |