From d38ecaa8564d256cab7cd55d841b7366157ccd8c Mon Sep 17 00:00:00 2001
From: Masayuki Nakano <masayuki@d-toybox.com>
Date: Thu, 15 Feb 2024 23:30:05 +0000
Subject: [PATCH] Bug 1879862 - Make `PresShell::HandleEvent` check whether the
 frame is alive after flushing synthesized mouse move r=smaug

Differential Revision: https://phabricator.services.mozilla.com/D201673
---
 layout/base/PresShell.cpp | 14 +++++++++++---
 1 file changed, 11 insertions(+), 3 deletions(-)

diff --git a/layout/base/PresShell.cpp b/layout/base/PresShell.cpp
index a2e2c7919adf..90a9eee4115d 100644
--- a/layout/base/PresShell.cpp
+++ b/layout/base/PresShell.cpp
@@ -6982,12 +6982,20 @@ nsresult PresShell::HandleEvent(nsIFrame* aFrameForPresShell,
         RefPtr<PresShell> rootPresShell =
             mPresContext->IsRoot() ? this : GetRootPresShell();
         if (rootPresShell && rootPresShell->mSynthMouseMoveEvent.IsPending()) {
+          AutoWeakFrame frameForPresShellWeak(aFrameForPresShell);
           RefPtr<nsSynthMouseMoveEvent> synthMouseMoveEvent =
               rootPresShell->mSynthMouseMoveEvent.get();
           synthMouseMoveEvent->Run();
-        }
-        if (IsDestroying()) {
-          return NS_OK;
+          if (IsDestroying()) {
+            return NS_OK;
+          }
+          // XXX If the frame or "this" is reframed, it might be better to
+          // recompute the frame.  However, it could treat the user input on
+          // unexpected element.  Therefore, we should not do that until we'd
+          // get a bug report caused by that.
+          if (MOZ_UNLIKELY(!frameForPresShellWeak.IsAlive())) {
+            return NS_OK;
+          }
         }
         break;
       }