bugzilla.mozilla.org has resumed normal operation. Attachments prior to 2014 will be unavailable for a few days. This is tracked in Bug 1475801.
Please report any other irregularities here.

Crash when window gets destroyed during DOMMouseScroll event

VERIFIED FIXED

Status

()

Core
Event Handling
--
critical
VERIFIED FIXED
12 years ago
12 years ago

People

(Reporter: Martijn Wargers (zombie), Assigned: smaug)

Tracking

(4 keywords)

Trunk
x86
Windows XP
crash, fixed1.8.1, testcase, verified1.8.0.5
Points:
---
Bug Flags:
blocking1.8.0.5 +

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(4 attachments)

(Reporter)

Description

12 years ago
See upcoming testcase, which crashes Mozilla builds when using the mousewheel over the iframe.
The crash also happens in Mozilla1.7, so no recent regression.

Talkback ID: TB18285705H
nsEventStateManager::DoScrollText   nsEventStateManager::PostHandleEvent   g_TOKEN_Directories
0x8b57f685
(Reporter)

Comment 1

12 years ago
Created attachment 220770 [details]
testcase
Created attachment 220773 [details] [diff] [review]
proposed patch
Assignee: events → Olli.Pettay
Status: NEW → ASSIGNED
Attachment #220773 - Flags: superreview?(bzbarsky)
Attachment #220773 - Flags: review?(bzbarsky)
Attachment #220773 - Flags: superreview?(bzbarsky)
Attachment #220773 - Flags: superreview+
Attachment #220773 - Flags: review?(bzbarsky)
Attachment #220773 - Flags: review+
Checking in nsEventStateManager.cpp;
/cvsroot/mozilla/content/events/src/nsEventStateManager.cpp,v  <--  nsEventStateManager.cpp
new revision: 1.646; previous revision: 1.645
done
Status: ASSIGNED → RESOLVED
Last Resolved: 12 years ago
Resolution: --- → FIXED
Verified FIXED using build 2006-05-04-16 of SeaMonkey trunk on Windows XP with the testcase: https://bugzilla.mozilla.org/attachment.cgi?id=220770&action=view.

No crash when using the mouse's scrollwheel.
Status: RESOLVED → VERIFIED
(Assignee)

Updated

12 years ago
Flags: blocking1.8.1?
Flags: blocking1.8.0.5?
Comment on attachment 220773 [details] [diff] [review]
proposed patch

Safe fix, just adding a null check.
Attachment #220773 - Flags: approval1.8.0.5?
Attachment #220773 - Flags: approval-branch-1.8.1?(bzbarsky)
Comment on attachment 220773 [details] [diff] [review]
proposed patch

Looks ok, but what's making sure aPresContext is alive here?  Do we need to hold a local strong ref to it?
Attachment #220773 - Flags: approval-branch-1.8.1?(bzbarsky) → approval-branch-1.8.1+
the event object has a strong reference to the prescontext.
Created attachment 222160 [details] [diff] [review]
1.8 version of the patch
(Assignee)

Updated

12 years ago
Flags: blocking1.8.1?
Keywords: fixed1.8.1
Flags: blocking1.8.0.5? → blocking1.8.0.5+
Comment on attachment 220773 [details] [diff] [review]
proposed patch

wrong patch for branch
Attachment #220773 - Flags: approval1.8.0.5? → approval1.8.0.5-
Comment on attachment 222160 [details] [diff] [review]
1.8 version of the patch

approved for 1.8.0 branch, a=dveditz for drivers
Attachment #222160 - Flags: approval1.8.0.5+
Created attachment 224523 [details] [diff] [review]
version for 1.8.0
(Assignee)

Updated

12 years ago
Keywords: fixed1.8.0.5

Updated

12 years ago
Keywords: fixed1.8.0.5 → verified1.8.0.5
You need to log in before you can comment on or make changes to this bug.