1246404 - crash in nsINode::IsInComposedDoc when doubleclick Titlebar or window border

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, defect)

Description

[Alice0775 White]

[Tracking Requested - why for this release]: Crash bug due to regression

This bug was filed from the Socorro interface and is 
report bp-b64f9dc4-e809-4671-aebf-50e4e2160206.
=============================================================

Build Identifier:
https://hg.mozilla.org/mozilla-central/rev/4295f9951e9331a2f2bd0a8ea8c4ad73af141a7b
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:47.0) Gecko/20100101 Firefox/47.0 ID:20160206030207

Tested 
on Windows7 x64 SP1 Home Premium, Classic style, Windows8.1.

If enabled the TitleBar,
When doubleclick Titlebar, then browser crashes.

The crash happens with new profile + enabled TitleBar.
This seems windows only problem.

Reproducible: always

Steps To Reproduce:
1. Enable TitleBar
2. Double click the TitleBar

Actual Results:
Browser crashes

Expected Results:
Should not crash
Should toggle window size mode.

Regression window:
https://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=db95299f4d30b9516ddc76c23402cbb3120be97c&tochange=c9585cb5a3cf9d59b8c1a13db5f9aa5776a18e14

Regressed by: Bug 591737

Comment 1

[Alice0775 White]

bp-c9e0cd6f-b748-483a-bbe2-3a4e62160206

Comment 2

[Alice0775 White]

And also Nightly crashes on Windows10 IP build14257.
bp-5448b2f4-9ea8-45ab-8062-09bc02160206

Comment 3

[Alice0775 White]

Also crash when doubleclick TitleBar of Page Info, Library and about Nightly.

Comment 4

[Alice0775 White]

And also crash when doubleclick window border

Comment 5

[Ting-Yu Lin [:TYLin] (PST, UTC-8)]

From the callstack, it looks like first presShell->HandleEventWithTarget() makes mouseContent became nullptr. We have to null check mouseContent before calling mouseContent->IsInComposedDoc().

[1] http://hg.mozilla.org/mozilla-central/annotate/4295f9951e93/dom/events/EventStateManager.cpp#l4686

Comment 6

[Ting-Yu Lin [:TYLin] (PST, UTC-8)]

Attachment: Check mouseContent before calling IsInComposedDoc().

It's possible that PresShell::HandleEventWithTarget() above will make
mouseContent become nullptr. We should check the validity of
mouseContent before calling its method.

Comment 7

[Olli Pettay [:smaug][[e-mail]]]

Comment on attachment 8716718 [details] [diff] [review]
Check mouseContent before calling IsInComposedDoc().

(I wonder if we should just make this method to return void and return early
in  if (!mouseContent && !mCurrentTarget) { by dropping the latter condition.)

But this is fine now.

Comment 8

[Ting-Yu Lin [:TYLin] (PST, UTC-8)]

Thanks. Let's land this first to fix the crash.

https://treeherder.mozilla.org/#/jobs?repo=try&revision=84a7232f0a05

Comment 9

[Pulsebot]

https://hg.mozilla.org/integration/mozilla-inbound/rev/a674340dc97e

Comment 10

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/a674340dc97e