336792 - [FIX]Crash during an mouseover event when alert is displayed and the window gets destroyed

Status: RESOLVED FIXED

(Core :: DOM: UI Events & Focus Handling, defect)

Description

[Martijn Wargers (dead)]

See upcoming testcase, which crashes current trunk builds.

Talkback ID: TB18341596X
nsEventStateManager::DispatchMouseEvent   nsEventStateManager::NotifyMouseOver   nsEventStateManager::GenerateMouseEnterExit   nsEventStateManager::PreHandleEvent   PresShell::HandleEventInternal   PresShell::HandlePositionedEvent   PresShell::HandleEvent   nsViewManager::HandleEvent   nsViewManager::DispatchEvent   HandleEvent   nsWindow::DispatchEvent   nsWindow::DispatchMouseEvent  

Not really sure when this regressed.
I can't get it to crash in 2006-02-22 trunk build, but I can get it to crash in 2006-02-23 SeaMonkey trunk build:
http://bonsai.mozilla.org/cvsquery.cgi?treeid=default&module=all&branch=HEAD&branchtype=match&dir=&file=&filetype=match&who=&whotype=match&sortby=Date&hours=2&date=explicit&mindate=2006-02-22+10&maxdate=2006-02-23+11&cvsroot=%2Fcvsroot
Maybe regression from bug 305181?

Note that I have to try it quite a few times before it crashes with the 2006-02-23 trunk build.
I have to reload the testcase with the 'reload' button. An interesting difference, with the 2006-02-22 trunk build, after pressing the 'reload' button, the mouseover event handler in the iframe is not executed, while it is in the 2006-02-23 trunk build.

2006-05-04 trunk build crashes directly at the first time. With the 2006-05-03 build, I have to reload a few times (by pressing the 'Go' button to get the crash.

Comment 1

[Martijn Wargers (dead)]

Attachment: testcase

Comment 2

[Martijn Wargers (dead)]

Attachment: Backtrace from debug build

#0  0x059eb2a2 in nsPresContext::GetPresShell() const (this=0x0)
    at ../../../../dist/include/layout/nsPresContext.h:176
#1  0x055d8cc4 in nsEventStateManager::DispatchMouseEvent(nsGUIEvent*, unsigned,
 nsIContent*, nsIContent*) (this=0xf3ed7d0, aEvent=0x22f4a8, aMessage=331,
    aTargetContent=0x102dff00, aRelatedContent=0x0)
    at c:/mozilla/mozilla/content/events/src/nsEventStateManager.cpp:2568
#2  0x055d922f in nsEventStateManager::NotifyMouseOver(nsGUIEvent*, nsIContent*)
 (this=0xf3ed7d0, aEvent=0x22f4a8, aContent=0x102dff00)
    at c:/mozilla/mozilla/content/events/src/nsEventStateManager.cpp:2692
etc..

Comment 3

[Boris Zbarsky [:bzbarsky]]

Attachment: mPresContext ends up null

Comment 4

[Olli Pettay [:smaug][[e-mail]]]

This was fixed in Bug 337520.

Comment 5

[Olli Pettay [:smaug][[e-mail]]]

Comment on attachment 220995 [details] [diff] [review]
mPresContext ends up null

so sr shouldn't be needed.