GitLab

WindowEventDispatcher can defer the processing of mouse/touch events
until a non-mouse/touch events comes or it's explicitly released.
If a target window of the deferred window destroys another window in
their event handler, the destruction is also deferred.
It can cause use-after-free if the following non-mouse/touch event's
target is the window being destroyed because searching of the target
window happens before the release of the deferred mouse events.

Bug: 1099985
Test: aura_unittests
Change-Id: Ia386bb99edd1374d1d39038ff44b3bfc73c26fa5
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2576983Reviewed-by: Sadrul Chowdhury <sadrul@chromium.org>
Commit-Queue: Yuichiro Hanada <yhanada@chromium.org>
Cr-Commit-Position: refs/heads/master@{#838584}