Bug 378371 - Crash [@ nsNativeDragTarget::ProcessDrag] when drag event handler and removing iframe, patch by Andrew Smith, r+sr=roc, (blocking1.9+)

widget/src/windows/nsNativeDragTarget.cpp

@@ -75,7 +75,7 @@ static POINTL gDragLastPoint;
 // construction
 //-----------------------------------------------------
 nsNativeDragTarget::nsNativeDragTarget(nsIWidget * aWnd)
-  : m_cRef(0), mWindow(aWnd), mCanMove(PR_TRUE)
+  : m_cRef(0), mWindow(aWnd), mCanMove(PR_TRUE), mDragCancelled(PR_FALSE)
 {
   mHWnd = (HWND)mWindow->GetNativeData(NS_NATIVE_WINDOW);
 
@@ -294,10 +294,15 @@ nsNativeDragTarget::DragOver(DWORD   grfKeyState,
 		return ResultFromScode(E_FAIL);
   }
 
+  // without the AddRef() |this| can get destroyed in an event handler
+  this->AddRef();
   mDragService->FireDragEventAtSource(NS_DRAGDROP_DRAG);
+  if (!mDragCancelled) {
+    // Now process the native drag state and then dispatch the event
+    ProcessDrag(nsnull, NS_DRAGDROP_OVER, grfKeyState, pt, pdwEffect);
+  }
+  this->Release();
 
-  // Now process the native drag state and then dispatch the event
-  ProcessDrag(nsnull, NS_DRAGDROP_OVER, grfKeyState, pt, pdwEffect);
   return S_OK;
 }
 

widget/src/windows/nsNativeDragTarget.h

@@ -90,6 +90,8 @@ public:
   STDMETHODIMP Drop(LPDATAOBJECT pSource, DWORD grfKeyState,
                     POINTL point, DWORD* pEffect);
 
+  PRBool           mDragCancelled;
+
 protected:
 
   void GetGeckoDragAction(LPDATAOBJECT pData, DWORD grfKeyState,

widget/src/windows/nsWindow.cpp

@@ -3096,6 +3096,7 @@ NS_METHOD nsWindow::EnableDragDrop(PRBool aEnable)
       if (S_OK == ::CoLockObjectExternal((LPUNKNOWN)mNativeDragTarget, FALSE, TRUE)) {
         rv = NS_OK;
       }
+      mNativeDragTarget->mDragCancelled = PR_TRUE;
       NS_RELEASE(mNativeDragTarget);
     }
   }
@@ -4608,11 +4609,11 @@ PRBool nsWindow::ProcessMessage(UINT msg, WPARAM wParam, LPARAM lParam, LRESULT
 #endif
 
     case WM_SETFOCUS:
-      result = DispatchFocus(NS_GOTFOCUS, PR_TRUE);
-      if (gJustGotActivate) {
-        gJustGotActivate = PR_FALSE;
-        gJustGotDeactivate = PR_FALSE;
-        result = DispatchFocus(NS_ACTIVATE, PR_TRUE);
+      result = DispatchFocus(NS_GOTFOCUS, PR_TRUE);
+      if (gJustGotActivate) {
+        gJustGotActivate = PR_FALSE;
+        gJustGotDeactivate = PR_FALSE;
+        result = DispatchFocus(NS_ACTIVATE, PR_TRUE);
       }
 
 #ifdef ACCESSIBILITY