1143972 - crash in mozilla::dom::Event::GetOffsetCoords(nsPresContext*, mozilla::WidgetEvent*, mozilla::gfx::IntPointTyped<mozilla::LayoutDevicePixel>, mozilla::gfx::IntPointTyped<mozilla::CSSPixel>)

Status: VERIFIED FIXED

(Core :: DOM: Events, defect)

Description

[(Away)]

This bug was filed from the Socorro interface and is 
report bp-0cc3572d-df2e-4d06-8ccf-212262150316.
=============================================================

Null |aPresContext| in GetOffsetCoords. This is the top crash on nightly 39 in recent builds.

mozilla::dom::Event::GetOffsetCoords(nsPresContext*, mozilla::WidgetEvent*, mozilla::gfx::IntPointTyped<mozilla::LayoutDevicePixel>, mozilla::gfx::IntPointTyped<mozilla::CSSPixel>)
mozilla::dom::MouseEventBinding::get_offsetY
js::Invoke(JSContext*, JS::CallArgs, js::MaybeConstruct)
js::Invoke(JSContext*, JS::Value const&, JS::Value const&, unsigned int, JS::Value const*, JS::MutableHandle<JS::Value>)
js::GetProperty(JSContext*, JS::Handle<JSObject*>, JS::Handle<JSObject*>, JS::Handle<jsid>, JS::MutableHandle<JS::Value>)

Comment 1

[Robert O'Callahan (:roc) (email my personal email if necessary)]

Attachment: Return 0,0 for offsetX/Y when the document has no presentation

Comment 2

[Robert O'Callahan (:roc) (email my personal email if necessary)]

https://hg.mozilla.org/integration/mozilla-inbound/rev/8a510633b96d

Comment 3

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/8a510633b96d

Comment 4

[[SV Manager] Florin Mezei, QA (:FlorinMezei)]

Socorro [1] shows zero crashes over the past 4 weeks, in builds after March 18th.

[1] - https://crash-stats.mozilla.com/report/list?range_unit=days&range_value=28&signature=mozilla%3A%3Adom%3A%3AEvent%3A%3AGetOffsetCoords%28nsPresContext%2A%2C+mozilla%3A%3AWidgetEvent%2A%2C+mozilla%3A%3Agfx%3A%3AIntPointTyped%3Cmozilla%3A%3ALayoutDevicePixel%3E%2C+mozilla%3A%3Agfx%3A%3AIntPointTyped%3Cmozilla%3A%3ACSSPixel%3E%29#tab-reports