2630 - Crash in EventStateManager during mouseOver/mouseOut

Status: VERIFIED FIXED

(Core :: DOM: UI Events & Focus Handling, defect, P2)

Description

[vidur (gone)]

Go to the page and mouse over and out of January 10th and similarly colored
dates, the main title and the big asterisk. Eventually, we crash with a null
pointer dereference and the following stack:

nsEventStateManager::GenerateMouseEnterExit(nsIPresContext & {...}, nsGUIEvent *
0x0012fdd0) line 259 + 30 bytes
nsEventStateManager::PreHandleEvent(nsEventStateManager * const 0x01689080,
nsIPresContext & {...}, nsGUIEvent * 0x0012fdd0, nsIFrame * 0x0166a360,
nsEventStatus & nsEventStatus_eConsumeDoDefault) line 86
PresShell::HandleEvent(PresShell * const 0x00f70ca4, nsIView * 0x01687970,
nsGUIEvent * 0x0012fdd0, nsEventStatus & nsEventStatus_eConsumeDoDefault) line
1299 + 34 bytes
nsView::HandleEvent(nsView * const 0x01687970, nsGUIEvent * 0x0012fdd0, unsigned
int 28, nsEventStatus & nsEventStatus_eConsumeDoDefault) line 789
nsViewManager::DispatchEvent(nsViewManager * const 0x00f71360, nsGUIEvent *
0x0012fdd0, nsEventStatus & nsEventStatus_eConsumeDoDefault) line 823
HandleEvent(nsGUIEvent * 0x0012fdd0) line 64
nsWindow::DispatchEvent(nsWindow * const 0x01687790, nsGUIEvent * 0x0012fdd0,
nsEventStatus & nsEventStatus_eIgnore) line 355 + 10 bytes
nsWindow::DispatchWindowEvent(nsGUIEvent * 0x0012fdd0) line 371
nsWindow::DispatchMouseEvent(unsigned int 300, nsPoint * 0x00000000) line 1849 +
15 bytes
nsWindow::ProcessMessage(unsigned int 512, unsigned int 0, long 524397, long *
0x0012fef4) line 1378 + 24 bytes
nsWindow::WindowProc(HWND__ * 0x002a0624, unsigned int 512, unsigned int 0, long
524397) line 414 + 27 bytes
USER32! 77e71250()

Comment 1

[joki (gone)]

Fixed.

Comment 2

[sujay]

joki, can you mark this VERIFIED_FIXED if it is?? thanks!

Comment 3

[joki (gone)]

Verified