61519 - crash in nsXBLPrototypeHandler::ExecuteHandler

Status: VERIFIED FIXED

(Core :: Layout, defect, P3)

Description

[Christopher Blizzard (:blizzard)]

It's possible to crash in nsXBLPrototypeHandler::ExecuteHandler if no mozilla
window has gotten focus yet and you scroll the window using a scrollbar.  The
scrollbar doesn't grab focus so no window is ever given focus.  Another problem
is that doing a |QueryInterface| on the DOM event receiver to an |nsIContent|
interface will fail.  That return isn't checked and will crash as well.

To reproduce this problem, fire up TestGtkEmbed to http://www.redhat.com.  It
should be small enough that it shows a scrollbar.  Grab the scrollbar slider and
slide it down the page.  You will get an assertion and a crash.

Patch attached in a moment.

Comment 1

[Christopher Blizzard (:blizzard)]

Attachment: patch

Comment 2

[Christopher Blizzard (:blizzard)]

Adding pink in the hopes of getting some hot review action.

Comment 3

[David Hyatt]

a=hyatt

Comment 4

[Christopher Blizzard (:blizzard)]

I think that this was fixed with the checkin that fixed 61452.  Checking on
that.  Hyatt, even if it was do you still want me to add these checks in?

Comment 5

[Chris Petersen]

I saw this problem too.

http://bugzilla.mozilla.org/show_bug.cgi?id=61510

Comment 6

[John Morrison]

This is a top crash, I believe -- see bug 59782 or bug 57982. I think it 
could use some extra love.

Comment 7

[Mike Pinkerton (not reading bugmail)]

this is definately different that what sfraser and I checked in earlier.

Comment 8

[Christopher Blizzard (:blizzard)]

OK, I'll check this in.  Those other bugs look similar but not exactly the same.
 pink, does this patch look OK to you?  I should technically have two reviews
before checking it in.

Comment 9

[Mike Pinkerton (not reading bugmail)]

i guess this looks ok, though i don't know this code at all. r=pink

Comment 10

[Asa Dotzler [:asa]]

*** Bug 61500 has been marked as a duplicate of this bug. ***

Comment 11

[John Morrison]

*** Bug 61548 has been marked as a duplicate of this bug. ***

Comment 12

[Christopher Blizzard (:blizzard)]

Checked in.

Comment 13

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

*** Bug 59782 has been marked as a duplicate of this bug. ***

Comment 14

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

*** Bug 59930 has been marked as a duplicate of this bug. ***

Comment 15

[Chris Petersen]

Verified fixed in the 2001010209 trunk build.