790164 - PresShell::DispatchTouchEvent should keep contentPresShell alive while using it

Status: RESOLVED FIXED

(Core :: Layout, defect)

Description

[Olli Pettay [:smaug][[e-mail]]]

I mentioned the problem few times in review comments, yet we have now an sg:crit bug ;)
https://bugzilla.mozilla.org/show_bug.cgi?id=732052#c44

Comment 1

[Wesley Johnston (:wesj)]

Attachment: Patch

Comment 2

[Wesley Johnston (:wesj)]

Attachment: Patch v2

Whoops. Sorry about that :(

Comment 3

[Olli Pettay [:smaug][[e-mail]]]

Comment on attachment 660147 [details] [diff] [review]
Patch v2

No need to assign nullptr.

Comment 4

[Wesley Johnston (:wesj)]

http://hg.mozilla.org/integration/mozilla-inbound/rev/89e726e160e5

Comment 5

[Wesley Johnston (:wesj)]

Comment on attachment 660147 [details] [diff] [review]
Patch v2

I assume we want to move this forward.

[Approval Request Comment]
Bug caused by (feature/regressing bug #): bug 732052
User impact if declined: Security risks if the presShell is destroyed by the touch event.
Testing completed (on m-c, etc.): landed on mc today (9/11/12)
Risk to taking this patch (and alternatives if risky): Low risk.
String or UUID changes made by this patch: None.

Comment 6

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/89e726e160e5

Comment 7

[Alex Keybl [:akeybl]]

sec-critical regression in FF16 - approved for landing on branches.

Comment 8

[Wesley Johnston (:wesj)]

https://hg.mozilla.org/releases/mozilla-beta/rev/e5f591a4b733
https://hg.mozilla.org/releases/mozilla-aurora/rev/75cf936e3bdc