336587 - Crash when window gets destroyed during DOMMouseScroll event

Status: VERIFIED FIXED

(Core :: DOM: UI Events & Focus Handling, defect)

Description

[Martijn Wargers (dead)]

See upcoming testcase, which crashes Mozilla builds when using the mousewheel over the iframe.
The crash also happens in Mozilla1.7, so no recent regression.

Talkback ID: TB18285705H
nsEventStateManager::DoScrollText   nsEventStateManager::PostHandleEvent   g_TOKEN_Directories
0x8b57f685

Comment 1

[Martijn Wargers (dead)]

Attachment: testcase

Comment 2

[Olli Pettay [:smaug][[e-mail]]]

Attachment: proposed patch

Comment 3

[Olli Pettay [:smaug][[e-mail]]]

Checking in nsEventStateManager.cpp;
/cvsroot/mozilla/content/events/src/nsEventStateManager.cpp,v  <--  nsEventStateManager.cpp
new revision: 1.646; previous revision: 1.645
done

Comment 4

[Stephen Donner [:stephend] Not actively reading bugmail]

Verified FIXED using build 2006-05-04-16 of SeaMonkey trunk on Windows XP with the testcase: https://bugzilla.mozilla.org/attachment.cgi?id=220770&action=view.

No crash when using the mouse's scrollwheel.

Comment 5

[Olli Pettay [:smaug][[e-mail]]]

Comment on attachment 220773 [details] [diff] [review]
proposed patch

Safe fix, just adding a null check.

Comment 6

[Boris Zbarsky [:bzbarsky]]

Comment on attachment 220773 [details] [diff] [review]
proposed patch

Looks ok, but what's making sure aPresContext is alive here?  Do we need to hold a local strong ref to it?

Comment 7

[Olli Pettay [:smaug][[e-mail]]]

the event object has a strong reference to the prescontext.

Comment 8

[Olli Pettay [:smaug][[e-mail]]]

Attachment: 1.8 version of the patch

Comment 9

[Daniel Veditz [:dveditz]]

Comment on attachment 220773 [details] [diff] [review]
proposed patch

wrong patch for branch

Comment 10

[Daniel Veditz [:dveditz]]

Comment on attachment 222160 [details] [diff] [review]
1.8 version of the patch

approved for 1.8.0 branch, a=dveditz for drivers

Comment 11

[Olli Pettay [:smaug][[e-mail]]]

Attachment: version for 1.8.0