Bug 1430813 - Prevent scenario where we keep a dead frame pointer on the EventStateManager. r?smaug
MozReview-Commit-ID: HN8XgsMGisy
--- a/layout/base/PresShell.cpp
+++ b/layout/base/PresShell.cpp
@@ -7207,36 +7207,39 @@ PresShell::HandleEvent(nsIFrame* aFrame,
pointerCapturingContent);
return NS_OK;
}
targetFrame = pointerCapturingContent->GetPrimaryFrame();
frame = targetFrame;
}
- AutoWeakFrame weakFrame(targetFrame);
+ AutoWeakFrame weakTargetFrame(targetFrame);
+ AutoWeakFrame weakFrame(frame);
nsCOMPtr<nsIContent> targetContent;
PointerEventHandler::DispatchPointerFromMouseOrTouch(
shell, targetFrame, targetElement, aEvent,
aDontRetargetEvents, aEventStatus,
getter_AddRefs(targetContent));
- if (!weakFrame.IsAlive() && aEvent->mClass == eMouseEventClass) {
+ if (!weakTargetFrame.IsAlive() && aEvent->mClass == eMouseEventClass) {
// Spec only defines that mouse events must be dispatched to the same
// target as the pointer event. If the target is no longer participating
// in its ownerDocument's tree, fire the event at the original target's
// nearest ancestor node
if (!targetContent) {
return NS_OK;
}
frame = targetContent->GetPrimaryFrame();
shell = GetShellForEventTarget(frame, targetContent);
if (!shell) {
return NS_OK;
}
+ } else if (!weakFrame.IsAlive()) {
+ return NS_OK;
}
}
// frame could be null after dispatching pointer events.
if (aEvent->mClass == eTouchEventClass) {
if (aEvent->mMessage == eTouchStart) {
WidgetTouchEvent* touchEvent = aEvent->AsTouchEvent();
if (nsIFrame* newFrame =