288739 - crash in nsEventStateManager::NotifyMouseOut

Status: RESOLVED WONTFIX

(Core :: DOM: Events, defect)

Description

[Vladimir Vukicevic [:vlad] [:vladv] (needinfo me, slow to respond)]

Attached patch fixes a crash in nsEventStateManager::NotifyMouseOut when moving
out of an element that doesn't implement nsIFrameFrame.  Seeing it with my
<canvas> element in trunk from 4/1; initializing subdocFrame to nsnull makes the
crash go away -- not sure if it's something specific to my <canvas> impl, as I
wasn't able to reproduce with other elements.

Comment 1

[Vladimir Vukicevic [:vlad] [:vladv] (needinfo me, slow to respond)]

Attachment: simple patch

Comment 2

[Boris Zbarsky [:bzbarsky]]

CallQI is guaranteed to set the out param to null if the QI fails, iirc.  If it
does not, someone's QI impl is broken.

Comment 3

[Boris Zbarsky [:bzbarsky]]

Is the impl in question in the tree somewhere?

Comment 4

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

But if the impl isn't "officially" broken then a better fix would be to check
the result of CallQueryInterface rather than the nullness of its out param.

Comment 5

[Vladimir Vukicevic [:vlad] [:vladv] (needinfo me, slow to respond)]

I'm not sure what object it's calling QI on; will try to figure that out.  My
own stuff all uses the macros which guarantee nsnull-ness, but by XPCOM rules it
shouldn't touch that out param if it throws an exception (returns
NS_NO_INTERFACE), no?  It seems that depending on the particular behaviour of
our macros is bad.

Comment 6

[Vladimir Vukicevic [:vlad] [:vladv] (needinfo me, slow to respond)]

It was my frame object, which had its own QueryInterface that didn't use the
macros.  Going to mark this bug as WONTFIX, as the assumes-return-set-to-nsnull
pattern is used in a bunch of other places, and will just fix my QI impl. :)