Closed Bug 478536 Opened 11 years ago Closed 11 years ago

Crash by removing a scroll target in MozMouseScrollFailed event handler

Categories

(Core :: User events and focus handling, defect, critical)

defect
Not set
critical

Tracking

()

RESOLVED FIXED

People

(Reporter: masayuki, Assigned: masayuki)

References

Details

(Keywords: crash, regression)

Attachments

(2 files, 1 obsolete file)

Attached file testcase
this is a regression of bug 442774.

At bug 442774, I added MozMouseScrollFailed event for automated testing, but the patch didn't check whether the target frame alive or not.

Steps for reproduce:
1. Open the attached testcase.
2. Scroll down the view to bottom by mouse wheel.
3. Scroll up the view to top by mouse wheel.
4. Scroll up the view to top again.

I'll post a patch.
Attached patch Patch v1.0 (obsolete) — Splinter Review
Attachment #362385 - Flags: superreview?(roc)
Attachment #362385 - Flags: review?(roc)
Comment on attachment 362385 [details] [diff] [review]
Patch v1.0

+      // By the event handler, the target frame might be destroyed.  Then,
+      // we should not keep to handle this scroll event.

// In the event handler, the target frame might be destroyed.  Then,
// we should not keep handling this scroll event.
Attachment #362385 - Flags: superreview?(roc)
Attachment #362385 - Flags: superreview+
Attachment #362385 - Flags: review?(roc)
Attachment #362385 - Flags: review+
pushed to trunk.
http://hg.mozilla.org/mozilla-central/rev/cc31eaf33c78
Status: ASSIGNED → RESOLVED
Closed: 11 years ago
Keywords: checkin-needed
Resolution: --- → FIXED
Component: Event Handling → User events and focus handling
You need to log in before you can comment on or make changes to this bug.