From 6a003eeb71be9a5e8f3c2546e8dfb913e1f057ad Mon Sep 17 00:00:00 2001
From: Greg Stoll <gstoll@mozilla.com>
Date: Tue, 17 Sep 2024 14:05:24 +0000
Subject: [PATCH] Bug 1918579 - don't crash when dropping with content analysis
 and focus changes r=masayuki,dlp-reviewers,handyman

Differential Revision: https://phabricator.services.mozilla.com/D222290
---
 dom/events/EventStateManager.cpp | 3 ++-
 dom/ipc/BrowserChild.cpp         | 2 ++
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/dom/events/EventStateManager.cpp b/dom/events/EventStateManager.cpp
index ec66ebdb8487..c371596b09ba 100644
--- a/dom/events/EventStateManager.cpp
+++ b/dom/events/EventStateManager.cpp
@@ -1566,7 +1566,8 @@ void EventStateManager::HandleQueryContentEvent(
 
   // If there is an IMEContentObserver, we need to handle QueryContentEvent
   // with it.
-  if (mIMEContentObserver) {
+  // eQueryDropTargetHittest is not really an IME event, though
+  if (mIMEContentObserver && aEvent->mMessage != eQueryDropTargetHittest) {
     RefPtr<IMEContentObserver> contentObserver = mIMEContentObserver;
     contentObserver->HandleQueryContentEvent(aEvent);
     return;
diff --git a/dom/ipc/BrowserChild.cpp b/dom/ipc/BrowserChild.cpp
index bd5e55b5de7f..97b24ad6d645 100644
--- a/dom/ipc/BrowserChild.cpp
+++ b/dom/ipc/BrowserChild.cpp
@@ -2086,6 +2086,8 @@ mozilla::ipc::IPCResult BrowserChild::RecvStoreDropTargetAndDelayEndDragSession(
     mDelayedDropPoint = queryEvent.mRefPoint;
     dragSession->StoreDropTargetAndDelayEndDragSession(
         queryEvent.mReply->mDropElement, queryEvent.mReply->mDropFrame);
+  } else {
+    MOZ_ASSERT(false, "Didn't get reply from eQueryDropTargetHittest event!");
   }
   return IPC_OK();
 }