Bug 1430813 - Prevent scenario where we keep a dead frame pointer on the EventStateManager. r=smaug
authorKartikaya Gupta <kgupta@mozilla.com>
Mon, 23 Apr 2018 09:35:12 -0400
changeset 468572 dcb911de9709c582b96987e47169c0ace592729e
parent 468571 983099e546d8ac5f677203e0ae39365164b1a131
child 468573 b5ad262142e36b66513bcce102acf6d4949b47c0
push id9165
push userasasaki@mozilla.com
push dateThu, 26 Apr 2018 21:04:54 +0000
treeherdermozilla-beta@064c3804de2e [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewerssmaug
bugs1430813
milestone61.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 1430813 - Prevent scenario where we keep a dead frame pointer on the EventStateManager. r=smaug MozReview-Commit-ID: HN8XgsMGisy
layout/base/PresShell.cpp
--- a/layout/base/PresShell.cpp
+++ b/layout/base/PresShell.cpp
@@ -7207,36 +7207,39 @@ PresShell::HandleEvent(nsIFrame* aFrame,
             pointerCapturingContent);
           return NS_OK;
         }
 
         targetFrame = pointerCapturingContent->GetPrimaryFrame();
         frame = targetFrame;
       }
 
-      AutoWeakFrame weakFrame(targetFrame);
+      AutoWeakFrame weakTargetFrame(targetFrame);
+      AutoWeakFrame weakFrame(frame);
       nsCOMPtr<nsIContent> targetContent;
       PointerEventHandler::DispatchPointerFromMouseOrTouch(
                              shell, targetFrame, targetElement, aEvent,
                              aDontRetargetEvents, aEventStatus,
                              getter_AddRefs(targetContent));
 
-      if (!weakFrame.IsAlive() && aEvent->mClass == eMouseEventClass) {
+      if (!weakTargetFrame.IsAlive() && aEvent->mClass == eMouseEventClass) {
         // Spec only defines that mouse events must be dispatched to the same
         // target as the pointer event. If the target is no longer participating
         // in its ownerDocument's tree, fire the event at the original target's
         // nearest ancestor node
         if (!targetContent) {
           return NS_OK;
         }
         frame = targetContent->GetPrimaryFrame();
         shell = GetShellForEventTarget(frame, targetContent);
         if (!shell) {
           return NS_OK;
         }
+      } else if (!weakFrame.IsAlive()) {
+        return NS_OK;
       }
     }
 
     // frame could be null after dispatching pointer events.
     if (aEvent->mClass == eTouchEventClass) {
       if (aEvent->mMessage == eTouchStart) {
         WidgetTouchEvent* touchEvent = aEvent->AsTouchEvent();
         if (nsIFrame* newFrame =