Bug 1397711 - Null-check widget of keyboard event before invoking its PostHandleKeyEvent. r=masayuki, a=gchang
authorXidorn Quan <me@upsuper.org>
Thu, 07 Sep 2017 22:07:34 +1000
changeset 424015 e0ce4bfc27efb49056631556f7462b15dc1ca9b4
parent 424014 5493550a05754ccd38bd90e3d73b58fe3aec14a0
child 424016 d3d0e187d53d5cafeaa050ae1893bc9523e45722
push id1517
push userjlorenzo@mozilla.com
push dateThu, 14 Sep 2017 16:50:54 +0000
treeherdermozilla-release@3b41fd564418 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersmasayuki, gchang
bugs1397711
milestone56.0
Bug 1397711 - Null-check widget of keyboard event before invoking its PostHandleKeyEvent. r=masayuki, a=gchang MozReview-Commit-ID: KTniEBMvw9q
dom/events/EventStateManager.cpp
dom/events/crashtests/1397711.html
dom/events/crashtests/crashtests.list
--- a/dom/events/EventStateManager.cpp
+++ b/dom/events/EventStateManager.cpp
@@ -2872,17 +2872,19 @@ EventStateManager::PostHandleKeyboardEve
     return;
   }
 
   if (!aKeyboardEvent->HasBeenPostedToRemoteProcess()) {
     // The widget expects a reply for every keyboard event. If the event wasn't
     // dispatched to a content process (non-e10s or no content process
     // running), we need to short-circuit here. Otherwise, we need to wait for
     // the content process to handle the event.
-    aKeyboardEvent->mWidget->PostHandleKeyEvent(aKeyboardEvent);
+    if (aKeyboardEvent->mWidget) {
+      aKeyboardEvent->mWidget->PostHandleKeyEvent(aKeyboardEvent);
+    }
     if (aKeyboardEvent->DefaultPrevented()) {
       aStatus = nsEventStatus_eConsumeNoDefault;
       return;
     }
   }
 
   // XXX Currently, our automated tests don't support mKeyNameIndex.
   //     Therefore, we still need to handle this with keyCode.
new file mode 100644
--- /dev/null
+++ b/dom/events/crashtests/1397711.html
@@ -0,0 +1,11 @@
+<!DOCTYPE html>
+<script>
+  let code = "x".charCodeAt(0);
+  let e = new KeyboardEvent("keypress", {
+    keyCode: code,
+    charCode: code,
+    bubbles: true
+  });
+  let utils = SpecialPowers.getDOMWindowUtils(window);
+  utils.dispatchDOMEventViaPresShell(document.documentElement, e, false);
+</script>
--- a/dom/events/crashtests/crashtests.list
+++ b/dom/events/crashtests/crashtests.list
@@ -11,8 +11,9 @@ load 1035654-1.html
 load 1035654-2.html
 needs-focus load 1072137-1.html
 load 1143972-1.html
 load 1190036-1.html
 load eventctor-nulldictionary.html
 load eventctor-nullstorage.html
 load recursive-DOMNodeInserted.html
 load recursive-onload.html
+load 1397711.html