From bcf39be0eabc261badaa36494e46c1f49711e0c0 Mon Sep 17 00:00:00 2001 From: Masayuki Nakano Date: Wed, 18 Feb 2009 00:55:53 +0900 Subject: [PATCH] Bug 478536 Crash by removing a scroll target in MozMouseScrollFailed event handler r+sr=roc --- content/events/src/nsEventStateManager.cpp | 12 ++ widget/tests/Makefile.in | 2 + widget/tests/test_bug478536.xul | 36 ++++ widget/tests/window_bug478536.xul | 204 +++++++++++++++++++++ 4 files changed, 254 insertions(+) create mode 100644 widget/tests/test_bug478536.xul create mode 100644 widget/tests/window_bug478536.xul diff --git a/content/events/src/nsEventStateManager.cpp b/content/events/src/nsEventStateManager.cpp index 5660114b710..85fc94431b7 100644 --- a/content/events/src/nsEventStateManager.cpp +++ b/content/events/src/nsEventStateManager.cpp @@ -377,6 +377,8 @@ public: static void BeginTransaction(nsIFrame* aTargetFrame, PRInt32 aNumLines, PRBool aScrollHorizontal); + // Be careful, UpdateTransaction may fire a DOM event, therefore, the target + // frame might be destroyed in the event handler. static PRBool UpdateTransaction(PRInt32 aNumLines, PRBool aScrollHorizontal); static void EndTransaction(); @@ -543,6 +545,10 @@ nsMouseWheelTransaction::OnFailToScrollTarget() sTargetFrame->GetContent(), NS_LITERAL_STRING("MozMouseScrollFailed"), PR_TRUE, PR_TRUE); + // The target frame might be destroyed in the event handler, at that time, + // we need to finish the current transaction + if (!sTargetFrame) + EndTransaction(); } void @@ -2734,6 +2740,12 @@ nsEventStateManager::DoScrollText(nsPresContext* aPresContext, nsIScrollableViewProvider* svp = do_QueryFrame(lastScrollFrame); if (svp && (scrollView = svp->GetScrollableView())) { nsMouseWheelTransaction::UpdateTransaction(aNumLines, aScrollHorizontal); + // When the scroll event will not scroll any views, UpdateTransaction + // fired MozMouseScrollFailed event which is for automated testing. + // In the event handler, the target frame might be destroyed. Then, + // we should not keep handling this scroll event. + if (!nsMouseWheelTransaction::GetTargetFrame()) + return NS_OK; } else { nsMouseWheelTransaction::EndTransaction(); lastScrollFrame = nsnull; diff --git a/widget/tests/Makefile.in b/widget/tests/Makefile.in index 49b58417bbc..5d98ac89013 100644 --- a/widget/tests/Makefile.in +++ b/widget/tests/Makefile.in @@ -60,6 +60,8 @@ include $(topsrcdir)/config/rules.mk _TEST_FILES = test_bug343416.xul \ test_bug444800.xul \ test_bug462106.xul \ + test_bug478536.xul \ + window_bug478536.xul \ test_keycodes.xul \ test_wheeltransaction.xul \ window_wheeltransaction.xul \ diff --git a/widget/tests/test_bug478536.xul b/widget/tests/test_bug478536.xul new file mode 100644 index 00000000000..3bfee11e392 --- /dev/null +++ b/widget/tests/test_bug478536.xul @@ -0,0 +1,36 @@ + + + + + + + Test for Bug 478536 + + + + diff --git a/widget/tests/window_bug478536.xul b/widget/tests/window_bug478536.xul new file mode 100644 index 00000000000..5bc0b23d575 --- /dev/null +++ b/widget/tests/window_bug478536.xul @@ -0,0 +1,204 @@ + + + + + + +