Don't invoke DropTarget's callback on destructor

When BrowserRootView is being destroyed, we shouldn't call callbacks from
DropTarget. It might be already destroyed.

Bug: 1001942
Change-Id: Iddecc9334d814f9154d44ff32473c5fa167b3b23
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1844001
Commit-Queue: Peter Kasting <pkasting@chromium.org>
Reviewed-by: Peter Kasting <pkasting@chromium.org>
Cr-Commit-Position: refs/heads/master@{#703352}

chrome/browser/ui/views/frame/browser_root_view.cc

@@ -106,7 +106,14 @@ BrowserRootView::BrowserRootView(BrowserView* browser_view,
                                  views::Widget* widget)
     : views::internal::RootView(widget), browser_view_(browser_view) {}
 
-BrowserRootView::~BrowserRootView() = default;
+BrowserRootView::~BrowserRootView() {
+  // It's possible to destroy the browser while a drop is active.  In this case,
+  // |drop_info_| will be non-null, but its |target| likely points to an
+  // already-deleted child.  Clear the target so ~DropInfo() will not try and
+  // notify it of the drag ending. http://crbug.com/1001942
+  if (drop_info_)
+    drop_info_->target = nullptr;
+}
 
 bool BrowserRootView::GetDropFormats(
     int* formats,

chrome/browser/ui/views/frame/browser_root_view_browsertest.cc

@@ -49,3 +49,19 @@ IN_PROC_BROWSER_TEST_F(BrowserRootViewBrowserTest, PlainString) {
   EXPECT_NE(ui::DragDropTypes::DRAG_NONE, root_view->OnDragUpdated(event));
   EXPECT_NE(ui::DragDropTypes::DRAG_NONE, root_view->OnPerformDrop(event));
 }
+
+// Clear drop target when the widget is being destroyed.
+// http://crbug.com/1001942
+IN_PROC_BROWSER_TEST_F(BrowserRootViewBrowserTest, ClearDropTarget) {
+  ui::OSExchangeData data;
+  data.SetURL(GURL("http://www.chromium.org/"), base::string16());
+  ui::DropTargetEvent event(data, gfx::PointF(), gfx::PointF(),
+                            ui::DragDropTypes::DRAG_COPY);
+
+  BrowserRootView* root_view = browser_root_view();
+  root_view->OnDragUpdated(event);
+
+  // Calling this will cause segmentation fault if |root_view| doesn't clear
+  // the target.
+  root_view->GetWidget()->Close();
+}