1663513 - Crash in [@ nsWindow::EventIsInsideWindow]

Status: RESOLVED FIXED

(Core :: Widget: Win32, defect, P3)

Description

[Gabriele Svelto [:gsvelto] (PTO)]

Crash report: https://crash-stats.mozilla.org/report/index/d0b01806-c65a-44a6-ad7d-96e4c0200905

Top 10 frames of crashing thread:

0 xul.dll static nsWindow::EventIsInsideWindow widget/windows/nsWindow.cpp:7969
1 xul.dll static nsWindow::GetPopupsToRollup widget/windows/nsWindow.cpp:7995
2 xul.dll static nsWindow::DealWithPopups widget/windows/nsWindow.cpp:8088
3 xul.dll static nsWindow::WindowProcInternal widget/windows/nsWindow.cpp:4974
4 xul.dll static nsWindow::WindowProc widget/windows/nsWindow.cpp:4932
5 user32.dll UserCallWinProcCheckWow 
6 user32.dll DispatchMessageWorker 
7 xul.dll nsAppShell::ProcessNextNativeEvent widget/windows/nsAppShell.cpp:737
8 xul.dll nsBaseAppShell::OnProcessNextEvent widget/nsBaseAppShell.cpp:259
9 xul.dll nsThread::ProcessNextEvent xpcom/threads/nsThread.cpp:1126

I found this during nightly crash triage but this isn't a new issue. There's crash reports going back a long way but it seems to have spiked with version 77. Most comments in the crash reports mention right clicking on the URL bar, possibly after left clicking somewhere else. A very large portion of the crash reports happened on YouTube.

The crash appears to be a NULL pointer dereference via the aWindow parameter.

Comment 1

[Stephen A Pohl [:spohl]]

Attachment: Bug 1663513: Add a null check to an existing assertion to prevent possible crashes related to popups and mouse events on Windows. r=handyman

Comment 2

[Marian-Vasile Laza]

https://hg.mozilla.org/mozilla-central/rev/700f2b9a22ff