337520 - Crash when window gets destroyed during mouseover event

Status: RESOLVED FIXED

(Core :: DOM: UI Events & Focus Handling, defect)

Description

[Martijn Wargers (dead)]

See upcoming testcase, which crashes Mozilla when moving the mouse over the iframe.
It doesn't happen all the time, then reload and try again (although, it happens almost every time for me in current trunk build).
I think the regression range is 2006-03-07/2006-03-08, which would make it a regression from bug 234455. However, I'm not sure since, I have more trouble getting older builds to crash and the ui in that time period was also broken for Firefox, which made it harder to test.

Talkback ID: TB18545976Q
nsEventStateManager::DispatchMouseEvent   nsEventStateManager::NotifyMouseOver   nsEventStateManager::GenerateMouseEnterExit   nsEventStateManager::PreHandleEvent   PresShell::HandleEventInternal   PresShell::HandlePositionedEvent   PresShell::HandleEvent   nsViewManager::HandleEvent   nsViewManager::DispatchEvent   HandleEvent   nsWindow::DispatchEvent   nsWindow::DispatchMouseEvent

Comment 1

[Martijn Wargers (dead)]

Attachment: testcase

Comment 2

[Martijn Wargers (dead)]

Attachment: testcase

This one is easier to crash with.

Comment 3

[Olli Pettay [:smaug][[e-mail]]]

Attachment: proposed patch

Using event callback (this is a valid use case for it) and making
sure that prescontext is alive even after event dispatch.
Not exactly related to this bug, but also making sure that
nsEventStateManager::DispatchMouseEvent returns a pointer to
an nsIFrame which is not dead. (nsFrame::HandleEvent may kill the frame :( )

Comment 4

[Boris Zbarsky [:bzbarsky]]

Comment on attachment 221691 [details] [diff] [review]
proposed patch

Looks good.

Comment 5

[Olli Pettay [:smaug][[e-mail]]]

Checking in nsEventStateManager.cpp;
/cvsroot/mozilla/content/events/src/nsEventStateManager.cpp,v  <--  nsEventStateManager.cpp
new revision: 1.652; previous revision: 1.651
done