Bug 1133629 IMEContentObserver should grab itself before using ContentEventHandler because it causes flushing pending layout r=smaug

This commit is contained in:
Masayuki Nakano 2015-02-17 22:20:08 +09:00
parent 6506436c23
commit fec2e93253

View File

@ -430,10 +430,12 @@ IMEContentObserver::OnMouseButtonEvent(nsPresContext* aPresContext,
default:
return false;
}
if (NS_WARN_IF(!mWidget)) {
if (NS_WARN_IF(!mWidget) || NS_WARN_IF(mWidget->Destroyed())) {
return false;
}
nsRefPtr<IMEContentObserver> kungFuDeathGrip(this);
WidgetQueryContentEvent charAtPt(true, NS_QUERY_CHARACTER_AT_POINT,
aMouseEvent->widget);
charAtPt.refPoint = aMouseEvent->refPoint;
@ -444,6 +446,12 @@ IMEContentObserver::OnMouseButtonEvent(nsPresContext* aPresContext,
return false;
}
// The widget might be destroyed during querying the content since it
// causes flushing layout.
if (!mWidget || NS_WARN_IF(mWidget->Destroyed())) {
return false;
}
// The result character rect is relative to the top level widget.
// We should notify it with offset in the widget.
nsIWidget* topLevelWidget = mWidget->GetTopLevelWidget();