12602 - CRASH! onLoad() DOM events being cast to GUI events

Status: VERIFIED FIXED

(Core :: DOM: Core & HTML, defect, P1)

Description

[Alec Flett]

I have an onLoad handler, and I was trying to spit out all the members of the
DOM event...and I've found that accessing many of these make it crash or do
wierd stuff:
screenX/screenY/pageX/pageY/clientX/clientY - tries to cast mEvent to a
nsGUIEvent, which it is not => crash
rangeParent, rangeOffset - causes the current javascript function to exit
silently.

to reproduce, just make any XUL with an onload="onLoad(event);" handler, and do
the usual
function onLoad(event) {
  for (var i in event)
    dump("event." + i + " = " + event[i] + "\n");
}

Comment 1

[Alec Flett]

by the way, some of the attributes are completely bogus, like layerX is 0 and
layerY is 71787075... and when I print out the object itself, I get [object
UIEvent] when I think it's really just an [object Event]

Comment 2

[Mike Shaver (:shaver -- probably not reading bugmail closely)]

Crashes are all M11/P1/critical.

Comment 3

[Mike Shaver (:shaver -- probably not reading bugmail closely)]

More event gifts from Vidur and I.

Comment 4

[joki (gone)]

Okay, this is a case of bad bounds checking when querying event attrs which
are not pertinent to the current event.  I'll see if I can lock it down.

Comment 5

[joki (gone)]

Okay, I have the fix for this.  It will be checked in later this evening but
I'm marking this fixed now to get it out of the way.

Comment 6

[leger]

Adding crash keyword

Comment 7

[Jan Carpenter]

Mass update of qa contact

Comment 8

[Alec Flett]

this isn't crashing for me anymore