From a4ad8c4b8a49e80aebaa91adb6ceeebe2caae8c4 Mon Sep 17 00:00:00 2001
From: "martijn.martijn@gmail.com" <martijn.martijn@gmail.com>
Date: Fri, 28 Sep 2007 15:45:14 -0700
Subject: [PATCH] Bug 378371 - Crash [@ nsNativeDragTarget::ProcessDrag] when
 drag event handler and removing iframe, patch by Andrew Smith, r+sr=roc,
 (blocking1.9+)

---
 widget/src/windows/nsNativeDragTarget.cpp | 11 ++++++++---
 widget/src/windows/nsNativeDragTarget.h   |  2 ++
 widget/src/windows/nsWindow.cpp           | 11 ++++++-----
 3 files changed, 16 insertions(+), 8 deletions(-)

diff --git a/widget/src/windows/nsNativeDragTarget.cpp b/widget/src/windows/nsNativeDragTarget.cpp
index 80e283fc84df..78bff4e74a49 100644
--- a/widget/src/windows/nsNativeDragTarget.cpp
+++ b/widget/src/windows/nsNativeDragTarget.cpp
@@ -75,7 +75,7 @@ static POINTL gDragLastPoint;
 // construction
 //-----------------------------------------------------
 nsNativeDragTarget::nsNativeDragTarget(nsIWidget * aWnd)
-  : m_cRef(0), mWindow(aWnd), mCanMove(PR_TRUE)
+  : m_cRef(0), mWindow(aWnd), mCanMove(PR_TRUE), mDragCancelled(PR_FALSE)
 {
   mHWnd = (HWND)mWindow->GetNativeData(NS_NATIVE_WINDOW);
 
@@ -294,10 +294,15 @@ nsNativeDragTarget::DragOver(DWORD   grfKeyState,
 		return ResultFromScode(E_FAIL);
   }
 
+  // without the AddRef() |this| can get destroyed in an event handler
+  this->AddRef();
   mDragService->FireDragEventAtSource(NS_DRAGDROP_DRAG);
+  if (!mDragCancelled) {
+    // Now process the native drag state and then dispatch the event
+    ProcessDrag(nsnull, NS_DRAGDROP_OVER, grfKeyState, pt, pdwEffect);
+  }
+  this->Release();
 
-  // Now process the native drag state and then dispatch the event
-  ProcessDrag(nsnull, NS_DRAGDROP_OVER, grfKeyState, pt, pdwEffect);
   return S_OK;
 }
 
diff --git a/widget/src/windows/nsNativeDragTarget.h b/widget/src/windows/nsNativeDragTarget.h
index c599e825d1e9..8462fc402f3f 100644
--- a/widget/src/windows/nsNativeDragTarget.h
+++ b/widget/src/windows/nsNativeDragTarget.h
@@ -90,6 +90,8 @@ public:
   STDMETHODIMP Drop(LPDATAOBJECT pSource, DWORD grfKeyState,
                     POINTL point, DWORD* pEffect);
 
+  PRBool           mDragCancelled;
+
 protected:
 
   void GetGeckoDragAction(LPDATAOBJECT pData, DWORD grfKeyState,
diff --git a/widget/src/windows/nsWindow.cpp b/widget/src/windows/nsWindow.cpp
index d1a11f6fad7a..0fd8629ed40d 100644
--- a/widget/src/windows/nsWindow.cpp
+++ b/widget/src/windows/nsWindow.cpp
@@ -3096,6 +3096,7 @@ NS_METHOD nsWindow::EnableDragDrop(PRBool aEnable)
       if (S_OK == ::CoLockObjectExternal((LPUNKNOWN)mNativeDragTarget, FALSE, TRUE)) {
         rv = NS_OK;
       }
+      mNativeDragTarget->mDragCancelled = PR_TRUE;
       NS_RELEASE(mNativeDragTarget);
     }
   }
@@ -4608,11 +4609,11 @@ PRBool nsWindow::ProcessMessage(UINT msg, WPARAM wParam, LPARAM lParam, LRESULT
 #endif
 
     case WM_SETFOCUS:
-      result = DispatchFocus(NS_GOTFOCUS, PR_TRUE);
-      if (gJustGotActivate) {
-        gJustGotActivate = PR_FALSE;
-        gJustGotDeactivate = PR_FALSE;
-        result = DispatchFocus(NS_ACTIVATE, PR_TRUE);
+      result = DispatchFocus(NS_GOTFOCUS, PR_TRUE);
+      if (gJustGotActivate) {
+        gJustGotActivate = PR_FALSE;
+        gJustGotDeactivate = PR_FALSE;
+        result = DispatchFocus(NS_ACTIVATE, PR_TRUE);
       }
 
 #ifdef ACCESSIBILITY