Fix use after free when handling async touch events

It's possible for the NativeView (aura::RootWindow*) in this case to
be destroyed by the time we end up processing the events.

BUG=288086
TEST=none
R=ananta@chromium.org

Review URL: https://chromiumcodereview.appspot.com/23619025

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@222167 0039d316-1c4b-4281-b951-d872f2087c98

ui/views/widget/desktop_aura/desktop_root_window_host_win.cc

@@ -765,9 +765,14 @@ bool DesktopRootWindowHostWin::HandleUntranslatedKeyEvent(
       OnHostKeyEvent(duplicate_event.get());
 }
 
-bool DesktopRootWindowHostWin::HandleTouchEvent(
+void DesktopRootWindowHostWin::HandleTouchEvent(
     const ui::TouchEvent& event) {
-  return root_window_host_delegate_->OnHostTouchEvent(
+  // HWNDMessageHandler asynchronously processes touch events. Because of this
+  // it's possible for the aura::RootWindow to have been destroyed by the time
+  // we attempt to process them.
+  if (!GetWidget()->GetNativeView())
+    return;
+  root_window_host_delegate_->OnHostTouchEvent(
       const_cast<ui::TouchEvent*>(&event));
 }
 

ui/views/widget/desktop_aura/desktop_root_window_host_win.h

@@ -178,7 +178,7 @@ class VIEWS_EXPORT DesktopRootWindowHostWin
   virtual bool HandleMouseEvent(const ui::MouseEvent& event) OVERRIDE;
   virtual bool HandleKeyEvent(const ui::KeyEvent& event) OVERRIDE;
   virtual bool HandleUntranslatedKeyEvent(const ui::KeyEvent& event) OVERRIDE;
-  virtual bool HandleTouchEvent(const ui::TouchEvent& event) OVERRIDE;
+  virtual void HandleTouchEvent(const ui::TouchEvent& event) OVERRIDE;
   virtual bool HandleIMEMessage(UINT message,
                                 WPARAM w_param,
                                 LPARAM l_param,

ui/views/widget/native_widget_win.cc

@@ -784,9 +784,8 @@ bool NativeWidgetWin::HandleUntranslatedKeyEvent(const ui::KeyEvent& event) {
   return !!input_method;
 }
 
-bool NativeWidgetWin::HandleTouchEvent(const ui::TouchEvent& event) {
+void NativeWidgetWin::HandleTouchEvent(const ui::TouchEvent& event) {
   NOTREACHED() << "Touch events are not supported";
-  return false;
 }
 
 bool NativeWidgetWin::HandleIMEMessage(UINT message,

ui/views/widget/native_widget_win.h

@@ -211,7 +211,7 @@ class VIEWS_EXPORT NativeWidgetWin : public internal::NativeWidgetPrivate,
   virtual bool HandleMouseEvent(const ui::MouseEvent& event) OVERRIDE;
   virtual bool HandleKeyEvent(const ui::KeyEvent& event) OVERRIDE;
   virtual bool HandleUntranslatedKeyEvent(const ui::KeyEvent& event) OVERRIDE;
-  virtual bool HandleTouchEvent(const ui::TouchEvent& event) OVERRIDE;
+  virtual void HandleTouchEvent(const ui::TouchEvent& event) OVERRIDE;
   virtual bool HandleIMEMessage(UINT message,
                                 WPARAM w_param,
                                 LPARAM l_param,

ui/views/win/hwnd_message_handler_delegate.h

@@ -185,9 +185,8 @@ class VIEWS_EXPORT HWNDMessageHandlerDelegate {
   // translation). Returns true if the event was sent to the input method.
   virtual bool HandleUntranslatedKeyEvent(const ui::KeyEvent& event) = 0;
 
-  // Called when a touch event is received. Returns true if the event was
-  // handled by the delegate.
-  virtual bool HandleTouchEvent(const ui::TouchEvent& event) = 0;
+  // Called when a touch event is received.
+  virtual void HandleTouchEvent(const ui::TouchEvent& event) = 0;
 
   // Called when an IME message needs to be processed by the delegate. Returns
   // true if the event was handled and no default processing should be