Closed Bug 455665 Opened 11 years ago Closed 11 years ago

nsSplitterFrameInner crashes in some special case

Categories

(Core :: Layout, defect)

x86
Linux
defect
Not set

Tracking

()

RESOLVED FIXED

People

(Reporter: romaxa, Unassigned)

Details

Attachments

(1 file)

Attached patch BugfixSplinter Review
nsSplitterFrameInner will crash if we have MouseDrag event after MouseUp...

Here
http://hg.mozilla.org/mozilla-central/file/287bb7a9c5d4/layout/xul/base/src/nsSplitterFrame.cpp#l527

we deleting mChildInfosBefore/After without resetting of mChildInfosBefore/AfterCount...

It will crash here:
http://hg.mozilla.org/mozilla-central/file/287bb7a9c5d4/layout/xul/base/src/nsSplitterFrame.cpp#l563
Attachment #339030 - Flags: review?(bzbarsky)
Attachment #339030 - Flags: superreview+
Attachment #339030 - Flags: review?(bzbarsky)
Attachment #339030 - Flags: review+
Fixed:
http://hg.mozilla.org/mozilla-central/rev/50f894002b47
Status: NEW → RESOLVED
Closed: 11 years ago
Resolution: --- → FIXED
Product: Core → Core Graveyard
Component: Layout: Misc Code → Layout
Product: Core Graveyard → Core
You need to log in before you can comment on or make changes to this bug.