526845 - incorrect plugin event type when nativeMsg generated by non-plugin view

Status: RESOLVED FIXED

(Core :: Widget: Cocoa, defect)

Description

[Josh Aas]

It is possible for a plugin to receive an event of the wrong event type when a non-plugin view sends an event to gecko which gets ultimately re-routed to the object frame.

Here is how it happens:

#13 0x14562070 in nsEventStateManager::DispatchMouseEvent (this=0x1f554df0, aEvent=0xbfffed08, aMessage=332, aTargetContent=0x1f5649c0, aRelatedContent=0x0) at /Users/josh/src/mozilla/ff_193_npapi_32/content/events/src/nsEventStateManager.cpp:3609
#14 0x1456234a in nsEventStateManager::NotifyMouseOut (this=0x1f554df0, aEvent=0xbfffed08, aMovingInto=0x0) at /Users/josh/src/mozilla/ff_193_npapi_32/content/events/src/nsEventStateManager.cpp:3674
...
#27 0x16aec3a6 in nsChildView::DispatchWindowEvent (this=0x1f47e510, event=@0xbfffed08) at /Users/josh/src/mozilla/ff_193_npapi_32/widget/src/cocoa/nsChildView.mm:1807
#28 0x16af9f88 in -[ChildView handleMouseMoved:] (self=0x1f47e5d0, _cmd=0x93b23bd6, theEvent=0x1ad2450) at /Users/josh/src/mozilla/ff_193_npapi_32/widget/src/cocoa/nsChildView.mm:3208
#29 0x16af0557 in ChildViewMouseTracker::MouseMoved (aEvent=0x1ad2450) at /Users/josh/src/mozilla/ff_193_npapi_32/widget/src/cocoa/nsChildView.mm:6500
#30 0x16af056f in -[ChildView mouseMoved:] (self=0x1ef61020, _cmd=0x9733d91c, aEvent=0x1ad2450) at /Users/josh/src/mozilla/ff_193_npapi_32/widget/src/cocoa/nsChildView.mm:3165

The plugin on the page here is a Cocoa event model plugin.

A mouse move event comes from the event queue in frame 30 to an NSView that is not a plugin view. This gets re-routed in frame 29 to another view, frame 28, which is also not a plugin view. At this point we generate a Carbon plugin event because Carbon is the default event model and the view is not a plugin view. This event ends up in nsEventStateManager, which in frame 14 notifies the Cocoa plugin of the mouse out. The problem is that the plugin event delivered is a Carbon event (EventRecord), which the plugin will almost certainly try to cast to an NPCocoaEvent.

Comment 1

[Josh Aas]

One option for fixing this is to not attach a nativeMsg when the view is not a plugin view. If we eventually need to generate a plugin event in that case we should do it in the object frame, which will have access to the correct event model.

Comment 2

[Josh Aas]

Attachment: fix v1.0

Comment 3

[Josh Aas]

pushed to mozilla-central

http://hg.mozilla.org/mozilla-central/rev/59e201d6b58b