Bug 1397711 - Null-check widget of keyboard event before invoking its PostHandleKeyEvent. r=masayuki

MozReview-Commit-ID: KTniEBMvw9q --HG-- extra : rebase_source : 3fa266b0097ee94f83c6567d5cebd66f41369d17
2017-09-07 22:07:34 +10:00 · 2017-09-07 22:07:34 +10:00 · 32fe2f2b94
--- a/dom/events/EventStateManager.cpp
+++ b/dom/events/EventStateManager.cpp
@ -2894,7 +2894,9 @@ EventStateManager::PostHandleKeyboardEvent(WidgetKeyboardEvent* aKeyboardEvent,
    // dispatched to a content process (non-e10s or no content process
    // running), we need to short-circuit here. Otherwise, we need to wait for
    // the content process to handle the event.
-    aKeyboardEvent->mWidget->PostHandleKeyEvent(aKeyboardEvent);
+    if (aKeyboardEvent->mWidget) {
+      aKeyboardEvent->mWidget->PostHandleKeyEvent(aKeyboardEvent);
+    }
    if (aKeyboardEvent->DefaultPrevented()) {
      aStatus = nsEventStatus_eConsumeNoDefault;
      return;
--- a/dom/events/crashtests/1397711.html
+++ b/dom/events/crashtests/1397711.html
@ -0,0 +1,11 @@
+<!DOCTYPE html>
+<script>
+  let code = "x".charCodeAt(0);
+  let e = new KeyboardEvent("keypress", {
+    keyCode: code,
+    charCode: code,
+    bubbles: true
+  });
+  let utils = SpecialPowers.getDOMWindowUtils(window);
+  utils.dispatchDOMEventViaPresShell(document.documentElement, e, false);
+</script>
--- a/dom/events/crashtests/crashtests.list
+++ b/dom/events/crashtests/crashtests.list
@ -16,3 +16,4 @@ load eventctor-nulldictionary.html
 load eventctor-nullstorage.html
 load recursive-DOMNodeInserted.html
 load recursive-onload.html
+load 1397711.html