[FIX]Crash during an mouseover event when alert is displayed and the window gets destroyed

RESOLVED FIXED in mozilla1.9alpha1

Status

()

Core
Event Handling
--
critical
RESOLVED FIXED
12 years ago
12 years ago

People

(Reporter: Martijn Wargers (dead), Assigned: bz)

Tracking

({crash, regression, testcase})

Trunk
mozilla1.9alpha1
x86
Windows XP
crash, regression, testcase
Points:
---

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(3 attachments)

(Reporter)

Description

12 years ago
See upcoming testcase, which crashes current trunk builds.

Talkback ID: TB18341596X
nsEventStateManager::DispatchMouseEvent   nsEventStateManager::NotifyMouseOver   nsEventStateManager::GenerateMouseEnterExit   nsEventStateManager::PreHandleEvent   PresShell::HandleEventInternal   PresShell::HandlePositionedEvent   PresShell::HandleEvent   nsViewManager::HandleEvent   nsViewManager::DispatchEvent   HandleEvent   nsWindow::DispatchEvent   nsWindow::DispatchMouseEvent  

Not really sure when this regressed.
I can't get it to crash in 2006-02-22 trunk build, but I can get it to crash in 2006-02-23 SeaMonkey trunk build:
http://bonsai.mozilla.org/cvsquery.cgi?treeid=default&module=all&branch=HEAD&branchtype=match&dir=&file=&filetype=match&who=&whotype=match&sortby=Date&hours=2&date=explicit&mindate=2006-02-22+10&maxdate=2006-02-23+11&cvsroot=%2Fcvsroot
Maybe regression from bug 305181?

Note that I have to try it quite a few times before it crashes with the 2006-02-23 trunk build.
I have to reload the testcase with the 'reload' button. An interesting difference, with the 2006-02-22 trunk build, after pressing the 'reload' button, the mouseover event handler in the iframe is not executed, while it is in the 2006-02-23 trunk build.

2006-05-04 trunk build crashes directly at the first time. With the 2006-05-03 build, I have to reload a few times (by pressing the 'Go' button to get the crash.
(Reporter)

Comment 1

12 years ago
Created attachment 220969 [details]
testcase
(Reporter)

Comment 2

12 years ago
Created attachment 220970 [details] [diff] [review]
Backtrace from debug build

#0  0x059eb2a2 in nsPresContext::GetPresShell() const (this=0x0)
    at ../../../../dist/include/layout/nsPresContext.h:176
#1  0x055d8cc4 in nsEventStateManager::DispatchMouseEvent(nsGUIEvent*, unsigned,
 nsIContent*, nsIContent*) (this=0xf3ed7d0, aEvent=0x22f4a8, aMessage=331,
    aTargetContent=0x102dff00, aRelatedContent=0x0)
    at c:/mozilla/mozilla/content/events/src/nsEventStateManager.cpp:2568
#2  0x055d922f in nsEventStateManager::NotifyMouseOver(nsGUIEvent*, nsIContent*)
 (this=0xf3ed7d0, aEvent=0x22f4a8, aContent=0x102dff00)
    at c:/mozilla/mozilla/content/events/src/nsEventStateManager.cpp:2692
etc..
Created attachment 220995 [details] [diff] [review]
mPresContext ends up null
Assignee: events → bzbarsky
Status: NEW → ASSIGNED
Attachment #220995 - Flags: superreview?(roc)
Attachment #220995 - Flags: review?
Summary: Crash during an mouseover event when alert is displayed and the window gets destroyed → [FIX]Crash during an mouseover event when alert is displayed and the window gets destroyed
Target Milestone: --- → mozilla1.9alpha
Attachment #220995 - Flags: review? → review?(Olli.Pettay)
Attachment #220995 - Flags: review?(Olli.Pettay) → review+
This was fixed in Bug 337520.
Status: ASSIGNED → RESOLVED
Last Resolved: 12 years ago
Resolution: --- → FIXED
Comment on attachment 220995 [details] [diff] [review]
mPresContext ends up null

so sr shouldn't be needed.
Attachment #220995 - Flags: superreview?(roc)
You need to log in before you can comment on or make changes to this bug.