All users were logged out of Bugzilla on October 13th, 2018

Crash [@ nsCOMPtr_base::~nsCOMPtr_base] when dragging splitter which gets removed during that time

VERIFIED FIXED

Status

()

--
critical
VERIFIED FIXED
12 years ago
12 years ago

People

(Reporter: martijn.martijn, Assigned: smaug)

Tracking

(4 keywords)

Trunk
x86
Windows XP
crash, testcase, verified1.8.0.9, verified1.8.1.1
Points:
---
Bug Flags:
blocking1.8.1.1 +
blocking1.8.0.9 +

Firefox Tracking Flags

(Not tracked)

Details

(crash signature)

Attachments

(2 attachments)

(Reporter)

Description

12 years ago
See upcoming testcase, which crashes current trunk builds, when dragging the splitter.
It also crashes Mozilla1.7.13, so no recent regression.

Talkback ID: TB23991545X
nsCOMPtr_base::~nsCOMPtr_base  [mozilla\xpcom\build\nscomptr.cpp, line 78]
nsSplitterInfo::`vector deleting destructor'
nsSplitterFrame::HandleEvent  [mozilla\layout\xul\base\src\nssplitterframe.cpp, line 475]
nsPresShellEventCB::HandleEvent  [mozilla\layout\base\nspresshell.cpp, line 1505]
nsEventDispatcher::Dispatch  [mozilla\content\events\src\nseventdispatcher.cpp, line 643]
PresShell::HandleEventInternal  [mozilla\layout\base\nspresshell.cpp, line 6263]
PresShell::HandlePositionedEvent  [mozilla\layout\base\nspresshell.cpp, line 6138]
PresShell::HandleEvent  [mozilla\layout\base\nspresshell.cpp, line 5966]
nsViewManager::HandleEvent  [mozilla\view\src\nsviewmanager.cpp, line 1668]
nsViewManager::DispatchEvent  [mozilla\view\src\nsviewmanager.cpp, line 1621]
HandleEvent  [mozilla\view\src\nsview.cpp, line 174]
nsWindow::DispatchEvent  [mozilla\widget\src\windows\nswindow.cpp, line 1108]
nsWindow::DispatchMouseEvent  [mozilla\widget\src\windows\nswindow.cpp, line 6110]
(Reporter)

Comment 1

12 years ago
Created attachment 240833 [details]
testcase
(Assignee)

Comment 2

12 years ago
Created attachment 240843 [details] [diff] [review]
proposed patch

Need to protect mInner and also use weakframe :(
Assignee: events → Olli.Pettay
Status: NEW → ASSIGNED
Attachment #240843 - Flags: superreview?(roc)
Attachment #240843 - Flags: review?(roc)
Attachment #240843 - Flags: superreview?(roc)
Attachment #240843 - Flags: superreview+
Attachment #240843 - Flags: review?(roc)
Attachment #240843 - Flags: review+
(Assignee)

Comment 3

12 years ago
Checked in
Status: ASSIGNED → RESOLVED
Last Resolved: 12 years ago
Resolution: --- → FIXED
(Assignee)

Updated

12 years ago
Attachment #240843 - Flags: approval1.8.0.9?
(Assignee)

Updated

12 years ago
Flags: blocking1.8.1.1?
Verified FIXED using https://bugzilla.mozilla.org/attachment.cgi?id=240833&action=view as a testcase in build 2006-10-15-06 of SeaMonkey trunk under Windows XP; I no longer crash.
Status: RESOLVED → VERIFIED
Comment on attachment 240843 [details] [diff] [review]
proposed patch

assuming the 1.8.0.9 approval request and the 1.8.1.1 blocking request means this bug applies to both (it's an old crash) then:

approved for 1.8/1.8.0 branches, a=dveditz for drivers
Attachment #240843 - Flags: approval1.8.1.1+
Attachment #240843 - Flags: approval1.8.0.9?
Attachment #240843 - Flags: approval1.8.0.9+
Flags: blocking1.8.1.1?
Flags: blocking1.8.1.1+
Flags: blocking1.8.0.9+
(Assignee)

Updated

12 years ago
Keywords: fixed1.8.0.9
(Assignee)

Comment 6

12 years ago
fixed1.8.0.9, fixed1.8.1.1
Keywords: fixed1.8.1.1
Verified fixed - tested with 1.8.0.9 and 1.8.1.1 on Windows XP x64 and Vista
Keywords: fixed1.8.0.9, fixed1.8.1.1 → verified1.8.0.9, verified1.8.1.1
Crash Signature: [@ nsCOMPtr_base::~nsCOMPtr_base]
You need to log in before you can comment on or make changes to this bug.