Closed Bug 355046 Opened 13 years ago Closed 13 years ago

Crash [@ nsCOMPtr_base::~nsCOMPtr_base] when dragging splitter which gets removed during that time

Categories

(Core :: DOM: UI Events & Focus Handling, defect, critical)

x86
Windows XP
defect
Not set
critical

Tracking

()

VERIFIED FIXED

People

(Reporter: martijn.martijn, Assigned: smaug)

Details

(4 keywords)

Crash Data

Attachments

(2 files)

See upcoming testcase, which crashes current trunk builds, when dragging the splitter.
It also crashes Mozilla1.7.13, so no recent regression.

Talkback ID: TB23991545X
nsCOMPtr_base::~nsCOMPtr_base  [mozilla\xpcom\build\nscomptr.cpp, line 78]
nsSplitterInfo::`vector deleting destructor'
nsSplitterFrame::HandleEvent  [mozilla\layout\xul\base\src\nssplitterframe.cpp, line 475]
nsPresShellEventCB::HandleEvent  [mozilla\layout\base\nspresshell.cpp, line 1505]
nsEventDispatcher::Dispatch  [mozilla\content\events\src\nseventdispatcher.cpp, line 643]
PresShell::HandleEventInternal  [mozilla\layout\base\nspresshell.cpp, line 6263]
PresShell::HandlePositionedEvent  [mozilla\layout\base\nspresshell.cpp, line 6138]
PresShell::HandleEvent  [mozilla\layout\base\nspresshell.cpp, line 5966]
nsViewManager::HandleEvent  [mozilla\view\src\nsviewmanager.cpp, line 1668]
nsViewManager::DispatchEvent  [mozilla\view\src\nsviewmanager.cpp, line 1621]
HandleEvent  [mozilla\view\src\nsview.cpp, line 174]
nsWindow::DispatchEvent  [mozilla\widget\src\windows\nswindow.cpp, line 1108]
nsWindow::DispatchMouseEvent  [mozilla\widget\src\windows\nswindow.cpp, line 6110]
Attached file testcase
Attached patch proposed patchSplinter Review
Need to protect mInner and also use weakframe :(
Assignee: events → Olli.Pettay
Status: NEW → ASSIGNED
Attachment #240843 - Flags: superreview?(roc)
Attachment #240843 - Flags: review?(roc)
Attachment #240843 - Flags: superreview?(roc)
Attachment #240843 - Flags: superreview+
Attachment #240843 - Flags: review?(roc)
Attachment #240843 - Flags: review+
Checked in
Status: ASSIGNED → RESOLVED
Closed: 13 years ago
Resolution: --- → FIXED
Attachment #240843 - Flags: approval1.8.0.9?
Flags: blocking1.8.1.1?
Verified FIXED using https://bugzilla.mozilla.org/attachment.cgi?id=240833&action=view as a testcase in build 2006-10-15-06 of SeaMonkey trunk under Windows XP; I no longer crash.
Status: RESOLVED → VERIFIED
Comment on attachment 240843 [details] [diff] [review]
proposed patch

assuming the 1.8.0.9 approval request and the 1.8.1.1 blocking request means this bug applies to both (it's an old crash) then:

approved for 1.8/1.8.0 branches, a=dveditz for drivers
Attachment #240843 - Flags: approval1.8.1.1+
Attachment #240843 - Flags: approval1.8.0.9?
Attachment #240843 - Flags: approval1.8.0.9+
Flags: blocking1.8.1.1?
Flags: blocking1.8.1.1+
Flags: blocking1.8.0.9+
Keywords: fixed1.8.0.9
fixed1.8.0.9, fixed1.8.1.1
Keywords: fixed1.8.1.1
Verified fixed - tested with 1.8.0.9 and 1.8.1.1 on Windows XP x64 and Vista
Crash Signature: [@ nsCOMPtr_base::~nsCOMPtr_base]
Component: Event Handling → User events and focus handling
You need to log in before you can comment on or make changes to this bug.