From 1f563afaa47fb4cbd0b3e7a56d8001c13ac5fc12 Mon Sep 17 00:00:00 2001
From: Victor Miura <[email protected]>
Date: Mon, 21 Sep 2026 16:14:35 -0700
Subject: [PATCH] [mac] Don't start web content drags during mouse capture

WebContentsViewMac::StartDragging refuses to start a dragging
session while a window move loop owns the held mouse button, but
not while a views widget owns it via mouse capture. A tab drag
only runs the move loop for its detached-window phase: dragging
tabs within the strip, and continuing the drag after the dragged
window attaches to another tab strip, hold mouse capture instead
(so do menus). A dragging session started mid-gesture would take
over the held mouse button and interfere with the gesture.

Refuse to start a dragging session while
CocoaMouseCapture::GetGlobalCaptureWindow() is non-nil, next to
the existing move loop check. Capture is released before
RunMoveLoop and re-acquired synchronously when the dragged
window re-attaches, so the two checks together cover the whole
gesture without overlapping. Web content drags are unaffected:
their mouse events are delivered to the RenderWidgetHostView's
NSView directly and never take views mouse capture.

TAG=agy
CONV=a8d563ec-9e59-4af7-87ea-349ca7292bd9

Bug: 553159183
Change-Id: Ia6b5560a7d50f84dd4c62b0b1976972e0dc88eef
Fixed: 553159183
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8433701
Auto-Submit: Victor Miura <[email protected]>
Reviewed-by: Avi Drissman <[email protected]>
Commit-Queue: Avi Drissman <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1702168}
---
diff --git a/content/browser/web_contents/web_contents_view_mac.mm b/content/browser/web_contents/web_contents_view_mac.mm
index 0950326..f6a08d0 100644
--- a/content/browser/web_contents/web_contents_view_mac.mm
+++ b/content/browser/web_contents/web_contents_view_mac.mm
@@ -20,6 +20,7 @@
 #include "base/task/current_thread.h"
 #include "base/task/thread_pool.h"
 #include "base/threading/thread_restrictions.h"
+#include "components/remote_cocoa/app_shim/mouse_capture.h"
 #include "components/remote_cocoa/app_shim/window_move_loop.h"
 #include "components/remote_cocoa/browser/ns_view_ids.h"
 #include "components/remote_cocoa/common/application.mojom.h"
@@ -234,6 +235,13 @@
     web_contents_->SystemDragEnded(source_rwh);
     return;
   }
+  // Likewise, a widget holding mouse capture (e.g. a tab strip during a tab
+  // drag, or an open menu) owns the held mouse button; refuse to start a
+  // dragging session that would interfere with its gesture.
+  if (remote_cocoa::CocoaMouseCapture::GetGlobalCaptureWindow()) {
+    web_contents_->SystemDragEnded(source_rwh);
+    return;
+  }
   url::Origin source_origin = source_rfh.GetLastCommittedOrigin();
   // By allowing nested tasks, the code below also allows Close(),
   // which would deallocate |this|.  The same problem can occur while
diff --git a/content/browser/web_contents/web_contents_view_mac_unittest.mm b/content/browser/web_contents/web_contents_view_mac_unittest.mm
index c348ed8..f5a3746 100644
--- a/content/browser/web_contents/web_contents_view_mac_unittest.mm
+++ b/content/browser/web_contents/web_contents_view_mac_unittest.mm
@@ -15,6 +15,8 @@
 #include "base/functional/callback_helpers.h"
 #include "base/memory/weak_ptr.h"
 #include "base/test/run_until.h"
+#include "components/remote_cocoa/app_shim/mouse_capture.h"
+#include "components/remote_cocoa/app_shim/mouse_capture_delegate.h"
 #include "content/browser/renderer_host/render_widget_host_impl.h"
 #include "content/browser/web_contents/web_contents_impl.h"
 #import "content/browser/web_contents/web_drag_dest_mac.h"
@@ -49,6 +51,25 @@
   bool was_called_ = false;
 };
 
+// Minimal capture delegate standing in for a widget that has acquired mouse
+// capture (as the bridge of a views::Widget does on SetCapture()).
+class TestMouseCaptureDelegate
+    : public remote_cocoa::CocoaMouseCaptureDelegate {
+ public:
+  explicit TestMouseCaptureDelegate(NSWindow* window) : window_(window) {}
+
+  TestMouseCaptureDelegate(const TestMouseCaptureDelegate&) = delete;
+  TestMouseCaptureDelegate& operator=(const TestMouseCaptureDelegate&) = delete;
+
+  // remote_cocoa::CocoaMouseCaptureDelegate:
+  bool PostCapturedEvent(NSEvent* event) override { return false; }
+  void OnMouseCaptureLost() override {}
+  NSWindow* GetWindow() const override { return window_; }
+
+ private:
+  NSWindow* __strong window_;
+};
+
 class WebContentsViewMacTest : public RenderViewHostImplTestHarness {
  public:
   void SetUp() override {
@@ -126,6 +147,48 @@
   EXPECT_TRUE(fake_client().was_called());
 }
 
+// A drag must not start while a widget holds mouse capture: the held mouse
+// button is driving that widget's gesture (e.g. a tab drag or an open menu).
+TEST_F(WebContentsViewMacTest, StartDragging_RefusedWhileMouseCaptureHeld) {
+  CocoaTestHelperWindow* window = [[CocoaTestHelperWindow alloc] init];
+  TestMouseCaptureDelegate capture_delegate(window);
+  remote_cocoa::CocoaMouseCapture capture(&capture_delegate);
+  ASSERT_TRUE(remote_cocoa::CocoaMouseCapture::GetGlobalCaptureWindow() != nil);
+
+  DropData drop_data;
+  drop_data.text = u"test data";
+
+  view()->StartDragging(*main_rfh(), drop_data, blink::kDragOperationCopy,
+                        CreateValidDragImage(), gfx::Vector2d(), gfx::Rect(),
+                        blink::mojom::DragEventSourceInfo());
+
+  // The drag request must be rejected before it reaches the policy check.
+  EXPECT_FALSE(fake_client().was_called());
+  [window close];
+}
+
+// Once mouse capture is released, drag requests must go through again.
+TEST_F(WebContentsViewMacTest, StartDragging_AllowedAfterMouseCaptureReleased) {
+  CocoaTestHelperWindow* window = [[CocoaTestHelperWindow alloc] init];
+  {
+    TestMouseCaptureDelegate capture_delegate(window);
+    remote_cocoa::CocoaMouseCapture capture(&capture_delegate);
+    ASSERT_TRUE(remote_cocoa::CocoaMouseCapture::GetGlobalCaptureWindow() !=
+                nil);
+  }
+  ASSERT_TRUE(remote_cocoa::CocoaMouseCapture::GetGlobalCaptureWindow() == nil);
+
+  DropData drop_data;
+  drop_data.text = u"test data";
+
+  view()->StartDragging(*main_rfh(), drop_data, blink::kDragOperationCopy,
+                        CreateValidDragImage(), gfx::Vector2d(), gfx::Rect(),
+                        blink::mojom::DragEventSourceInfo());
+
+  EXPECT_TRUE(fake_client().was_called());
+  [window close];
+}
+
 TEST_F(WebContentsViewMacTest, InitiallyHiddenButPaintingNativeView) {
   WebContents::CreateParams params(browser_context());
   params.initially_hidden_but_painting = true;
diff --git a/content/test/BUILD.gn b/content/test/BUILD.gn
index 8df08ed6..b25c211 100644
--- a/content/test/BUILD.gn
+++ b/content/test/BUILD.gn
@@ -3576,6 +3576,7 @@
   }
   if (is_mac) {
     deps += [
+      "//components/remote_cocoa/app_shim",
       "//crypto:test_support",
       "//device/fido:icloud_keychain_test_support",
       "//sandbox/mac:seatbelt",

diff --git a/content/browser/web_contents/web_contents_view_mac_unittest.mm b/content/browser/web_contents/web_contents_view_mac_unittest.mm
index c348ed8..f5a3746 100644
--- a/content/browser/web_contents/web_contents_view_mac_unittest.mm
+++ b/content/browser/web_contents/web_contents_view_mac_unittest.mm
@@ -15,6 +15,8 @@
 #include "base/functional/callback_helpers.h"
 #include "base/memory/weak_ptr.h"
 #include "base/test/run_until.h"
+#include "components/remote_cocoa/app_shim/mouse_capture.h"
+#include "components/remote_cocoa/app_shim/mouse_capture_delegate.h"
 #include "content/browser/renderer_host/render_widget_host_impl.h"
 #include "content/browser/web_contents/web_contents_impl.h"
 #import "content/browser/web_contents/web_drag_dest_mac.h"
@@ -49,6 +51,25 @@
   bool was_called_ = false;
 };
 
+// Minimal capture delegate standing in for a widget that has acquired mouse
+// capture (as the bridge of a views::Widget does on SetCapture()).
+class TestMouseCaptureDelegate
+    : public remote_cocoa::CocoaMouseCaptureDelegate {
+ public:
+  explicit TestMouseCaptureDelegate(NSWindow* window) : window_(window) {}
+
+  TestMouseCaptureDelegate(const TestMouseCaptureDelegate&) = delete;
+  TestMouseCaptureDelegate& operator=(const TestMouseCaptureDelegate&) = delete;
+
+  // remote_cocoa::CocoaMouseCaptureDelegate:
+  bool PostCapturedEvent(NSEvent* event) override { return false; }
+  void OnMouseCaptureLost() override {}
+  NSWindow* GetWindow() const override { return window_; }
+
+ private:
+  NSWindow* __strong window_;
+};
+
 class WebContentsViewMacTest : public RenderViewHostImplTestHarness {
  public:
   void SetUp() override {
@@ -126,6 +147,48 @@
   EXPECT_TRUE(fake_client().was_called());
 }
 
+// A drag must not start while a widget holds mouse capture: the held mouse
+// button is driving that widget's gesture (e.g. a tab drag or an open menu).
+TEST_F(WebContentsViewMacTest, StartDragging_RefusedWhileMouseCaptureHeld) {
+  CocoaTestHelperWindow* window = [[CocoaTestHelperWindow alloc] init];
+  TestMouseCaptureDelegate capture_delegate(window);
+  remote_cocoa::CocoaMouseCapture capture(&capture_delegate);
+  ASSERT_TRUE(remote_cocoa::CocoaMouseCapture::GetGlobalCaptureWindow() != nil);
+
+  DropData drop_data;
+  drop_data.text = u"test data";
+
+  view()->StartDragging(*main_rfh(), drop_data, blink::kDragOperationCopy,
+                        CreateValidDragImage(), gfx::Vector2d(), gfx::Rect(),
+                        blink::mojom::DragEventSourceInfo());
+
+  // The drag request must be rejected before it reaches the policy check.
+  EXPECT_FALSE(fake_client().was_called());
+  [window close];
+}
+
+// Once mouse capture is released, drag requests must go through again.
+TEST_F(WebContentsViewMacTest, StartDragging_AllowedAfterMouseCaptureReleased) {
+  CocoaTestHelperWindow* window = [[CocoaTestHelperWindow alloc] init];
+  {
+    TestMouseCaptureDelegate capture_delegate(window);
+    remote_cocoa::CocoaMouseCapture capture(&capture_delegate);
+    ASSERT_TRUE(remote_cocoa::CocoaMouseCapture::GetGlobalCaptureWindow() !=
+                nil);
+  }
+  ASSERT_TRUE(remote_cocoa::CocoaMouseCapture::GetGlobalCaptureWindow() == nil);
+
+  DropData drop_data;
+  drop_data.text = u"test data";
+
+  view()->StartDragging(*main_rfh(), drop_data, blink::kDragOperationCopy,
+                        CreateValidDragImage(), gfx::Vector2d(), gfx::Rect(),
+                        blink::mojom::DragEventSourceInfo());
+
+  EXPECT_TRUE(fake_client().was_called());
+  [window close];
+}
+
 TEST_F(WebContentsViewMacTest, InitiallyHiddenButPaintingNativeView) {
   WebContents::CreateParams params(browser_context());
   params.initially_hidden_but_painting = true;
diff --git a/content/test/BUILD.gn b/content/test/BUILD.gn
index 8df08ed6..b25c211 100644
--- a/content/test/BUILD.gn
+++ b/content/test/BUILD.gn
@@ -3576,6 +3576,7 @@
   }
   if (is_mac) {
     deps += [
+      "//components/remote_cocoa/app_shim",
       "//crypto:test_support",
       "//device/fido:icloud_keychain_test_support",
       "//sandbox/mac:seatbelt",