345371 - Check before using weak pointer in nsCaret (Crash [@ nsCaret::DrawCaret])

Status: RESOLVED FIXED

(Core :: Layout, defect)

Description

[Eli Friedman]

Talkback ID TB21175066W.  Not reproducable, but it's easy to guess what's causing the crash, and it really should get fixed in any case.  Using a weak
pointer without checking it's valid is a bad idea.

http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/layout/base/nsCaret.cpp&rev=1.160&mark=985-986#984

It's apparently rare; Talkback says there have been 62 crashes in nsCaret::DrawCaret since late March.

Easy patch coming up to fix all the unchecked uses of mPresShell.

Setting dependency on bug 305798 since that patch added the relevant code.

Comment 1

[Eli Friedman]

Attachment: Patch

Comment 2

[Uri Bernstein]

In my defense, there was already one use of the unchecked weak pointer (in GetCaretCoordinates) prior to my fix for bug 305798. I probably just copied that to the other places.

Anyway, thanks for finding this and providing a patch.

Comment 3

[Eli Friedman]

Checked in.

Comment 4

[Eli Friedman]

Comment on attachment 230004 [details] [diff] [review]
Patch

Probably a good idea to get this on the branch.

Comment 5

[Darin Fisher]

Comment on attachment 230004 [details] [diff] [review]
Patch

a=darin on behalf of drivers

Comment 6

[Martijn Wargers (dead)]

Attachment: patch for 1.8.1 branch

Comment 7

[Martijn Wargers (dead)]

Attachment: patch for1.8.1 branch

The trunk patch doesn't apply cleanly to the 1.8.1 branch. Someone should check if this patch is correct for the 1.8.1 branch, I think it is.

Comment 8

[Eli Friedman]

Missed 
http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/layout/base/nsCaret.cpp&rev=MOZILLA_1_8_BRANCH&cvsroot=/cvsroot&mark=552-555#550

Looks good otherwise; thanks.

Comment 9

[Martijn Wargers (dead)]

Attachment: patch for 1.8.1 branch

Ok, thanks, then I guess this is good to go in.

Comment 10

[Martijn Wargers (dead)]

Checking in nsCaret.cpp;
/cvsroot/mozilla/layout/base/nsCaret.cpp,v  <--  nsCaret.cpp
new revision: 1.144.2.9; previous revision: 1.144.2.8
done

Checked into 1.8.1 branch.