115632 - crash addreffing (nsIWidget *) 0xdbdbdbdb when mEvent->eventStructType == NS_EVENT [@nsDOMEvent::GetClientX]

Status: VERIFIED FIXED

(Core :: DOM: Events, defect)

Description

[timeless]

#0  0x29119ca1 in nsDOMEvent::GetClientX (this=0x295db800, aClientX=0xbfbf7ce0) at /home/timeless/mozilla/content/events/src/nsDOMEvent.cpp:679
679       NS_ADDREF(parent);
(gdb) where
#0  0x29119ca1 in nsDOMEvent::GetClientX (this=0x295db800, aClientX=0xbfbf7ce0) at /home/timeless/mozilla/content/events/src/nsDOMEvent.cpp:679
#1  0x2828b590 in XPTC_InvokeByIndex (that=0x295db808, methodIndex=18, paramCount=1, params=0xbfbf7ce0)
    at /home/timeless/mozilla/xpcom/reflect/xptcall/src/md/unix/xptcinvoke_unixish_x86.cpp:153

(gdb) p parent
$1 = (nsIWidget *) 0xdbdbdbdb
(gdb) p mEvent->eventStructType
$6 = 1 '\001'

Full stack trace available. This was triggered with a custom dom event.

I have a simple fix. remove the highlighted line.

Comment 1

[timeless]

w/ the obvious change, we die at the next logical point:
#0  0x2911a13d in nsDOMEvent::GetClientY (this=0x295db800, aClientY=0xbfbf7c64) at /home/timeless/mozilla/content/events/src/nsDOMEvent.cpp:732
732       NS_ADDREF(parent);
(gdb) p parent
$1 = (nsIWidget *) 0x8d
(gdb)  p mEvent->eventStructType
$2 = 1 '\001'

Comment 2

[timeless]

Attachment: only check mouse events for coordinates

Comment 3

[Joe Hewitt (gone)]

You can't remove those lines, I added them in a few weeks ago so that custom dom
events, specifically the popup events, can have mouse coordinates.

Comment 4

[Joe Hewitt (gone)]

Attachment: this should work

Comment 5

[timeless]

Comment on attachment 63872 [details] [diff] [review]
this should work

i don't understand it, but it works.

Comment 6

[timeless]

alecf: would you sr=?

Comment 7

[Alec Flett]

Comment on attachment 63872 [details] [diff] [review]
this should work

sr=alecf

Comment 8

[Joe Hewitt (gone)]

fixed

Comment 9

[Vladimir Ermakov]

Can one of the developer's please verify?

Comment 10

[Joe Hewitt (gone)]

suuure, it's verified