Bug 1250560 - Fix crash in HandleTouchEvent. r=roc
authorTing-Yu Lin <tlin@mozilla.com>
Sun, 28 Feb 2016 23:16:45 +0800
changeset 322398 8ad96eb28e4fb4903c326987e07cf2fded0e67b6
parent 322397 de97989a2d9b4775fc7cb0adef2b393ab6ecea97
child 322399 bc33885d20340641e06cc40031618dd30ccd6567
push id5913
push userjlund@mozilla.com
push dateMon, 25 Apr 2016 16:57:49 +0000
treeherdermozilla-beta@dcaf0a6fa115 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersroc
bugs1250560
milestone47.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 1250560 - Fix crash in HandleTouchEvent. r=roc When enabling "dom.w3c_pointer_events.enabled", we might get a eTouchCancel event without any touch data. That is, aEvent->touches is an empty array. We need to make sure it's non-empty before accessing aEvent->touches[0]. MozReview-Commit-ID: BQUsrJjHHEl
layout/base/AccessibleCaretEventHub.cpp
--- a/layout/base/AccessibleCaretEventHub.cpp
+++ b/layout/base/AccessibleCaretEventHub.cpp
@@ -541,16 +541,21 @@ AccessibleCaretEventHub::HandleMouseEven
   }
 
   return rv;
 }
 
 nsEventStatus
 AccessibleCaretEventHub::HandleTouchEvent(WidgetTouchEvent* aEvent)
 {
+  if (aEvent->touches.IsEmpty()) {
+    AC_LOG("%s: Receive a touch event without any touch data!", __FUNCTION__);
+    return nsEventStatus_eIgnore;
+  }
+
   nsEventStatus rv = nsEventStatus_eIgnore;
 
   int32_t id = (mActiveTouchId == kInvalidTouchId ?
                 aEvent->touches[0]->Identifier() : mActiveTouchId);
   nsPoint point = GetTouchEventPosition(aEvent, id);
 
   switch (aEvent->mMessage) {
   case eTouchStart: