1 files changed, 39 insertions, 2 deletions

diff --git a/webkit/glue/webview_impl.cc b/webkit/glue/webview_impl.cc
index 03db938..e974d44 100644
--- a/webkit/glue/webview_impl.cc
+++ b/webkit/glue/webview_impl.cc
@@ -363,6 +363,8 @@ WebViewImpl::WebViewImpl()
       ime_accept_events_(true),
       drag_target_dispatch_(false),
       drag_identity_(0),
+      drop_effect_(DROP_EFFECT_DEFAULT),
+      drop_accept_(false),
       autocomplete_popup_showing_(false) {
   // WebKit/win/WebView.cpp does the same thing, except they call the
   // KJS specific wrapper around this method. We need to have threading
@@ -1632,11 +1634,15 @@ bool WebViewImpl::DragTargetDragEnter(
       webkit_glue::WebPointToIntPoint(client_point),
       webkit_glue::WebPointToIntPoint(screen_point),
       kDropTargetOperation);
+
+  drop_effect_ = DROP_EFFECT_DEFAULT;
   drag_target_dispatch_ = true;
   DragOperation effect = page_->dragController()->dragEntered(&drag_data);
   drag_target_dispatch_ = false;
 
-  return effect != DragOperationNone;
+  if (drop_effect_ != DROP_EFFECT_DEFAULT)
+    return drop_accept_ = (drop_effect_ != DROP_EFFECT_NONE);
+  return drop_accept_ = (effect != DragOperationNone);
 }
 
 bool WebViewImpl::DragTargetDragOver(
@@ -1649,11 +1655,15 @@ bool WebViewImpl::DragTargetDragOver(
       webkit_glue::WebPointToIntPoint(client_point),
       webkit_glue::WebPointToIntPoint(screen_point),
       kDropTargetOperation);
+
+  drop_effect_ = DROP_EFFECT_DEFAULT;
   drag_target_dispatch_ = true;
   DragOperation effect = page_->dragController()->dragUpdated(&drag_data);
   drag_target_dispatch_ = false;
 
-  return effect != DragOperationNone;
+  if (drop_effect_ != DROP_EFFECT_DEFAULT)
+    return drop_accept_ = (drop_effect_ != DROP_EFFECT_NONE);
+  return drop_accept_ = (effect != DragOperationNone);
 }
 
 void WebViewImpl::DragTargetDragLeave() {
@@ -1664,11 +1674,14 @@ void WebViewImpl::DragTargetDragLeave() {
       IntPoint(),
       IntPoint(),
       kDropTargetOperation);
+
   drag_target_dispatch_ = true;
   page_->dragController()->dragExited(&drag_data);
   drag_target_dispatch_ = false;
 
   current_drag_data_ = NULL;
+  drop_effect_ = DROP_EFFECT_DEFAULT;
+  drop_accept_ = false;
   drag_identity_ = 0;
 }
 
@@ -1677,16 +1690,31 @@ void WebViewImpl::DragTargetDrop(
     const WebPoint& screen_point) {
   DCHECK(current_drag_data_.get());
 
+  // If this webview transitions from the "drop accepting" state to the "not
+  // accepting" state, then our IPC message reply indicating that may be in-
+  // flight, or else delayed by javascript processing in this webview.  If a
+  // drop happens before our IPC reply has reached the browser process, then
+  // the browser forwards the drop to this webview.  So only allow a drop to
+  // proceed if our webview drop_accept_ state is true.
+
+  if (!drop_accept_) {  // IPC RACE CONDITION: do not allow this drop.
+    DragTargetDragLeave();
+    return;
+  }
+
   DragData drag_data(
       current_drag_data_.get(),
       webkit_glue::WebPointToIntPoint(client_point),
       webkit_glue::WebPointToIntPoint(screen_point),
       kDropTargetOperation);
+
   drag_target_dispatch_ = true;
   page_->dragController()->performDrag(&drag_data);
   drag_target_dispatch_ = false;
 
   current_drag_data_ = NULL;
+  drop_effect_ = DROP_EFFECT_DEFAULT;
+  drop_accept_ = false;
   drag_identity_ = 0;
 }
 
@@ -1696,6 +1724,15 @@ int32 WebViewImpl::GetDragIdentity() {
   return 0;
 }
 
+bool WebViewImpl::SetDropEffect(bool accept) {
+  if (drag_target_dispatch_) {
+    drop_effect_ = accept ? DROP_EFFECT_COPY : DROP_EFFECT_NONE;
+    return true;
+  } else {
+    return false;
+  }
+}
+
 SearchableFormData* WebViewImpl::CreateSearchableFormDataForFocusedNode() {
   if (!page_.get())
     return NULL;