diff options
| author | sky@chromium.org <sky@chromium.org@0039d316-1c4b-4281-b951-d872f2087c98> | 2013-09-10 01:16:04 +0000 |
|---|---|---|
| committer | sky@chromium.org <sky@chromium.org@0039d316-1c4b-4281-b951-d872f2087c98> | 2013-09-10 01:16:04 +0000 |
| commit | 51c9e29fb16d0640be64b876bed5f79bc2ce79fc (patch) | |
| tree | 20548458aeba8f7c55979b6b0156fe3ddce1707c /ui/views/widget | |
| parent | 5a87613850079cccfbf590c29b9d2db0c3ed19f5 (diff) | |
| download | chromium_src-51c9e29fb16d0640be64b876bed5f79bc2ce79fc.zip chromium_src-51c9e29fb16d0640be64b876bed5f79bc2ce79fc.tar.gz chromium_src-51c9e29fb16d0640be64b876bed5f79bc2ce79fc.tar.bz2 | |
Fix use after free when handling async touch events
It's possible for the NativeView (aura::RootWindow*) in this case to
be destroyed by the time we end up processing the events.
BUG=288086
TEST=none
R=ananta@chromium.org
Review URL: https://chromiumcodereview.appspot.com/23619025
git-svn-id: svn://svn.chromium.org/chrome/trunk/src@222167 0039d316-1c4b-4281-b951-d872f2087c98
Diffstat (limited to 'ui/views/widget')
4 files changed, 10 insertions, 6 deletions
diff --git a/ui/views/widget/desktop_aura/desktop_root_window_host_win.cc b/ui/views/widget/desktop_aura/desktop_root_window_host_win.cc index d81aeb8..63f6be3 100644 --- a/ui/views/widget/desktop_aura/desktop_root_window_host_win.cc +++ b/ui/views/widget/desktop_aura/desktop_root_window_host_win.cc @@ -765,9 +765,14 @@ bool DesktopRootWindowHostWin::HandleUntranslatedKeyEvent( OnHostKeyEvent(duplicate_event.get()); } -bool DesktopRootWindowHostWin::HandleTouchEvent( +void DesktopRootWindowHostWin::HandleTouchEvent( const ui::TouchEvent& event) { - return root_window_host_delegate_->OnHostTouchEvent( + // HWNDMessageHandler asynchronously processes touch events. Because of this + // it's possible for the aura::RootWindow to have been destroyed by the time + // we attempt to process them. + if (!GetWidget()->GetNativeView()) + return; + root_window_host_delegate_->OnHostTouchEvent( const_cast<ui::TouchEvent*>(&event)); } diff --git a/ui/views/widget/desktop_aura/desktop_root_window_host_win.h b/ui/views/widget/desktop_aura/desktop_root_window_host_win.h index 483b634..0428243 100644 --- a/ui/views/widget/desktop_aura/desktop_root_window_host_win.h +++ b/ui/views/widget/desktop_aura/desktop_root_window_host_win.h @@ -178,7 +178,7 @@ class VIEWS_EXPORT DesktopRootWindowHostWin virtual bool HandleMouseEvent(const ui::MouseEvent& event) OVERRIDE; virtual bool HandleKeyEvent(const ui::KeyEvent& event) OVERRIDE; virtual bool HandleUntranslatedKeyEvent(const ui::KeyEvent& event) OVERRIDE; - virtual bool HandleTouchEvent(const ui::TouchEvent& event) OVERRIDE; + virtual void HandleTouchEvent(const ui::TouchEvent& event) OVERRIDE; virtual bool HandleIMEMessage(UINT message, WPARAM w_param, LPARAM l_param, diff --git a/ui/views/widget/native_widget_win.cc b/ui/views/widget/native_widget_win.cc index 472ff9c..ea0b069 100644 --- a/ui/views/widget/native_widget_win.cc +++ b/ui/views/widget/native_widget_win.cc @@ -784,9 +784,8 @@ bool NativeWidgetWin::HandleUntranslatedKeyEvent(const ui::KeyEvent& event) { return !!input_method; } -bool NativeWidgetWin::HandleTouchEvent(const ui::TouchEvent& event) { +void NativeWidgetWin::HandleTouchEvent(const ui::TouchEvent& event) { NOTREACHED() << "Touch events are not supported"; - return false; } bool NativeWidgetWin::HandleIMEMessage(UINT message, diff --git a/ui/views/widget/native_widget_win.h b/ui/views/widget/native_widget_win.h index 544e18b..1db1835 100644 --- a/ui/views/widget/native_widget_win.h +++ b/ui/views/widget/native_widget_win.h @@ -211,7 +211,7 @@ class VIEWS_EXPORT NativeWidgetWin : public internal::NativeWidgetPrivate, virtual bool HandleMouseEvent(const ui::MouseEvent& event) OVERRIDE; virtual bool HandleKeyEvent(const ui::KeyEvent& event) OVERRIDE; virtual bool HandleUntranslatedKeyEvent(const ui::KeyEvent& event) OVERRIDE; - virtual bool HandleTouchEvent(const ui::TouchEvent& event) OVERRIDE; + virtual void HandleTouchEvent(const ui::TouchEvent& event) OVERRIDE; virtual bool HandleIMEMessage(UINT message, WPARAM w_param, LPARAM l_param, |