585961 - Crash [@ nsNativeDragTarget::Drop(IDataObject*, unsigned long, _POINTL, unsigned long*) ]

Status: RESOLVED FIXED

(Core :: Widget: Win32, defect)

Description

[Mats Palmgren (inactive)]

Crash [@ nsNativeDragTarget::Drop(IDataObject*, unsigned long, _POINTL, unsigned long*) ].

I found this crash while investigating bug 585287.
It seems to be a regression from bug 530070 in that it makes
the crash more likely to occur, but we should fix this with or
without bug 530070.

STEPS TO REPRODUCE
0. bookmark a page that is slow to load, in my case it works with
   http://slashdot.org/
1. open the Bookmarks window
2. select the bookmark from step 0 and drag-n-drop onto the content window
3. do this a few times in rapid succession, ie. without waiting for the
   page to load

ACTUAL RESULTS
http://crash-stats.mozilla.com/report/index/74465092-f724-46d3-80f2-151622100810

The problem is that nsNativeDragTarget::Drop is using 'this' after
ProcessDrag() was called (even though there is a warning that it
might be destroyed on line 406).
http://hg.mozilla.org/mozilla-central/annotate/961f253985a4/widget/src/windows/nsNativeDragTarget.cpp#l430

Comment 1

[Mats Palmgren (inactive)]

This is most likely very hard to reproduce without the changes
in bug 530070.  Marking it Security-Sensitive just in case, since the code
in nsNativeDragTarget::Drop is the same on branches (although they don't
have bug 530070 yet).

Comment 2

[Martijn Wargers (dead)]

Would bug 556892 be related to this?

Comment 3

[Mats Palmgren (inactive)]

Possibly.  Can you attach the unminimized testcase somewhere safe?

Comment 4

[Mats Palmgren (inactive)]

Attachment: Patch rev. 1

Comment 5

[chris hofmann]

looks like we currently see up to 7 of these crashes per day.  could be people just testing for this, or could be content in the wild that we need to keep an eye out for.

Comment 6

[Mats Palmgren (inactive)]

Comment on attachment 464447 [details] [diff] [review]
Patch rev. 1

roc, can you review this since jimm is on vacation?

Comment 7

[Mats Palmgren (inactive)]

http://hg.mozilla.org/mozilla-central/rev/4815acde2305