60895 - crash in mozilla/layout/html/base/src/nsObjectFrame.cpp:nsPluginInstanceOwner::ProcessEvent()

Status: VERIFIED FIXED

(Core Graveyard :: Plug-ins, defect, P3)

Description

[serge (gone)]

simple check of (mInstance != NULL) which already implemented for XP_MAC
here is patch proposal:
Index: nsObjectFrame.cpp
===================================================================
RCS file: /cvsroot/mozilla/layout/html/base/src/nsObjectFrame.cpp,v
retrieving revision 1.181.4.6
diff -u -r1.181.4.6 nsObjectFrame.cpp
--- nsObjectFrame.cpp   2000/11/04 00:01:35     1.181.4.6
+++ nsObjectFrame.cpp   2000/11/21 21:57:54
@@ -2493,8 +2493,8 @@
 nsEventStatus nsPluginInstanceOwner::ProcessEvent(const nsGUIEvent& anEvent)
 {
        nsEventStatus rv = nsEventStatus_eIgnore;
-#ifdef XP_MAC
        if (mInstance != NULL) {
+#ifdef XP_MAC
                EventRecord* event = (EventRecord*)anEvent.nativeMsg;
                if (event == NULL || event->what == nullEvent) {
                        EventRecord macEvent;
@@ -2507,7 +2507,6 @@
                mInstance->HandleEvent(&pluginEvent, &eventHandled);
                if (eventHandled)
                        rv = nsEventStatus_eConsumeNoDefault;
-       }
 #endif

 //~~~
@@ -2518,7 +2517,7 @@
                if (eventHandled)
                        rv = nsEventStatus_eConsumeNoDefault;
 #endif
-
+  }
   return rv;
 }

Comment 1

[serge (gone)]

the original url I found this problem is http://www.nfl.com
there is macromedia flash plugin on left side of the page, rapidly clicking 
(don't have to do so on slow ~200Mhz box)
on "TEAMS" link causes this crash. 
The local copy of this test case is here 
http://jazz/users/serge/publish/bugzilla/60859/0.html 

Comment 2

[shrirang khanzode]

well , I could not crash on today's trunk 1218. We have another bug 63243 for a 
crash on the same website, though.

Comment 3

[Keyser Sose]

Worksforme
Platform: PC
OS: Windows 98
Mozilla: #2000121804 M18 Trunk Build

Comment 4

[serge (gone)]

well, I can easily crash 2000121804 on nt4.0
first click on "TEAMS" menu item (left side of the page) causes the crash:(
see TB report 23224820
but the stack trace for this report is corresponding to bug 63243,
and it does not match the stack trace for current bug which should look like:
 nsPluginInstanceOwner::ProcessEvent
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsObjectFrame.cpp, line 2518]
 nsPluginInstanceOwner::MouseDown
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsObjectFrame.cpp, line 2440]
 nsEventListenerManager::HandleEvent
[d:\builds\seamonkey\mozilla\layout\events\src\nsEventListenerManager.cpp, line 
856]
 nsGenericElement::HandleDOMEvent
[d:\builds\seamonkey\mozilla\layout\base\src\nsGenericElement.cpp, line 1405]
 nsHTMLHeadElement::HandleDOMEvent
[d:\builds\seamonkey\mozilla\layout\html\content\src\nsHTMLHeadElement.cpp, line 
181]
......
see TB report 23268923

Comment 5

[Peter Lubczynski]

With the patch to nsObjectFrame.cpp in bug 54437, this should be fixed. The 
patch is: http://bugzilla.mozilla.org/showattachment.cgi?attach_id=22177

Marking FIXED.

Comment 6

[shrirang khanzode]

I can't reproduce the crash on win trunk build 2001011604. Seems to have got
fixed. VERIFIED.