[Backport] Security bug 1185482

Cherry-pick of patch originally reviewed on
https://chromium-review.googlesource.com/c/chromium/src/+/2779886:
x11/ozone: fix two edge cases

WindowTreeHost::OnHostMovedInPixels() may trigger a nested message
loop (tab dragging), which when the stack unravels means this may
be deleted. This adds an early out if this happens.

X11WholeScreenMoveLoop has a similar issue, in so far as notifying
the delegate may delete this.

BUG=1185482
TEST=WindowTreeHostPlatform.DeleteHostFromOnHostMovedInPixels

(cherry picked from commit 5e3a738b1204941aab9f15c0eb3d06e20fefd96e)

Change-Id: Ieca1c90b3e4358da50b332abe2941fdbb50c5c25
Reviewed-by: Thomas Anderson <thomasanderson@chromium.org>
Commit-Queue: Scott Violet <sky@chromium.org>
Cr-Original-Commit-Position: refs/heads/master@{#860852}
Cr-Commit-Position: refs/branch-heads/4389@{#1583}
Cr-Branched-From: 9251c5db2b6d5a59fe4eac7aafa5fed37c139bb7-refs/heads/master@{#843830}
Reviewed-by: Jüri Valdmann <juri.valdmann@qt.io>

Author: Scott Violet

chromium/ui/aura/window_tree_host_platform.cc

@@ -214,13 +214,21 @@ void WindowTreeHostPlatform::OnBoundsChanged(const gfx::Rect& new_bounds) {
   float current_scale = compositor()->device_scale_factor();
   float new_scale = ui::GetScaleFactorForNativeView(window());
   gfx::Rect old_bounds = bounds_in_pixels_;
+  auto weak_ref = GetWeakPtr();
   bounds_in_pixels_ = new_bounds;
-  if (bounds_in_pixels_.origin() != old_bounds.origin())
+  if (bounds_in_pixels_.origin() != old_bounds.origin()) {
     OnHostMovedInPixels(bounds_in_pixels_.origin());
+    // Changing the bounds may destroy this.
+    if (!weak_ref)
+      return;
+  }
   if (bounds_in_pixels_.size() != old_bounds.size() ||
       current_scale != new_scale) {
     pending_size_ = gfx::Size();
     OnHostResizedInPixels(bounds_in_pixels_.size());
+    // Changing the size may destroy this.
+    if (!weak_ref)
+      return;
   }
   DCHECK_GT(on_bounds_changed_recursion_depth_, 0);
   if (--on_bounds_changed_recursion_depth_ == 0) {

chromium/ui/aura/window_tree_host_platform_unittest.cc

@@ -34,7 +34,7 @@ class TestWindowTreeHost : public WindowTreeHostPlatform {
 // OnHostWill/DidProcessBoundsChange. Additionally, this triggers a bounds
 // change from within OnHostResized(). Such a scenario happens in production
 // code.
-class TestWindowTreeHostObserver : public aura::WindowTreeHostObserver {
+class TestWindowTreeHostObserver : public WindowTreeHostObserver {
  public:
   TestWindowTreeHostObserver(WindowTreeHostPlatform* host,
                              ui::PlatformWindow* platform_window)
@@ -51,7 +51,7 @@ class TestWindowTreeHostObserver : public aura::WindowTreeHostObserver {
     return on_host_will_process_bounds_change_count_;
   }
 
-  // aura::WindowTreeHostObserver:
+  // WindowTreeHostObserver:
   void OnHostResized(WindowTreeHost* host) override {
     if (!should_change_bounds_in_on_resized_)
       return;
@@ -92,5 +92,41 @@ TEST_F(WindowTreeHostPlatformTest, HostWillProcessBoundsChangeRecursion) {
   EXPECT_EQ(1, observer.on_host_will_process_bounds_change_count());
 }
 
+// Deletes WindowTreeHostPlatform from OnHostMovedInPixels().
+class DeleteHostWindowTreeHostObserver : public WindowTreeHostObserver {
+ public:
+  explicit DeleteHostWindowTreeHostObserver(
+      std::unique_ptr<TestWindowTreeHost> host)
+      : host_(std::move(host)) {
+    host_->AddObserver(this);
+  }
+  ~DeleteHostWindowTreeHostObserver() override = default;
+
+  TestWindowTreeHost* host() { return host_.get(); }
+
+  // WindowTreeHostObserver:
+  void OnHostMovedInPixels(WindowTreeHost* host,
+                           const gfx::Point& new_origin_in_pixels) override {
+    host_->RemoveObserver(this);
+    host_.reset();
+  }
+
+ private:
+  std::unique_ptr<TestWindowTreeHost> host_;
+
+  DISALLOW_COPY_AND_ASSIGN(DeleteHostWindowTreeHostObserver);
+};
+
+// Verifies WindowTreeHostPlatform can be safely deleted when calling
+// OnHostMovedInPixels().
+// Regression test for https://crbug.com/1185482
+TEST_F(WindowTreeHostPlatformTest, DeleteHostFromOnHostMovedInPixels) {
+  std::unique_ptr<TestWindowTreeHost> host =
+      std::make_unique<TestWindowTreeHost>();
+  DeleteHostWindowTreeHostObserver observer(std::move(host));
+  observer.host()->SetBoundsInPixels(gfx::Rect(1, 2, 3, 4));
+  EXPECT_EQ(nullptr, observer.host());
+}
+
 }  // namespace
 }  // namespace aura

chromium/ui/base/x/x11_whole_screen_move_loop.cc

@@ -64,9 +64,13 @@ X11WholeScreenMoveLoop::~X11WholeScreenMoveLoop() {
 void X11WholeScreenMoveLoop::DispatchMouseMovement() {
   if (!last_motion_in_screen_)
     return;
+  auto weak_ref = weak_factory_.GetWeakPtr();
   delegate_->OnMouseMovement(last_motion_in_screen_->root_location(),
                              last_motion_in_screen_->flags(),
                              last_motion_in_screen_->time_stamp());
+  // The delegate may delete this during dispatch.
+  if (!weak_ref)
+    return;
   last_motion_in_screen_.reset();
 }