113639 - random crashes in mail, r=mscott, sr=hyatt

layout/xul/base/src/nsXULTooltipListener.cpp

@@ -52,6 +52,9 @@
 #include "nsGUIEvent.h"
 #include "nsIPrivateDOMEvent.h"
 #include "nsIPresContext.h"
+#include "nsIScriptContext.h"
+#include "nsIScriptGlobalObject.h"
+#include "nsIDOMWindowInternal.h"
 
 //////////////////////////////////////////////////////////////////////////
 //// nsISupports
@@ -335,6 +338,7 @@ nsXULTooltipListener::CheckOutlinerBodyMove(nsIDOMMouseEvent* aMouseEvent)
     // determine if we are going to need a titletip
     // XXX check the disabletitletips attribute on the outliner content
     mNeedTitletip = PR_FALSE;
+#ifdef DEBUG_crap
     if (obj.Equals(NS_LITERAL_STRING("text"))) {
       nsCOMPtr<nsIOutlinerView> view;
       mOutlinerBox->GetView(getter_AddRefs(view));
@@ -346,9 +350,10 @@ nsXULTooltipListener::CheckOutlinerBodyMove(nsIDOMMouseEvent* aMouseEvent)
         mNeedTitletip = isCropped;
       }
     }
+#endif
 
-
-    if (row != mLastOutlinerRow || !mLastOutlinerCol.Equals(colId)) {
+    if (mCurrentTooltip && 
+        (row != mLastOutlinerRow || !mLastOutlinerCol.Equals(colId))) {
       HideTooltip();
     } 
 
@@ -505,7 +510,6 @@ nsXULTooltipListener::HideTooltip()
   }
 
   DestroyTooltip();
-
   return NS_OK;
 }
 
@@ -540,6 +544,21 @@ nsXULTooltipListener::GetTooltipFor(nsIContent* aTarget, nsIContent** aTooltip)
   if (!targetEl)
     return NS_ERROR_FAILURE; // could be a text node or something
 
+  // before we go on, make sure that target node still has a window
+  nsCOMPtr<nsIDocument> document;
+  if (NS_FAILED(aTarget->GetDocument(*getter_AddRefs(document))) || !document) {
+    NS_ERROR("Unable to retrieve the tooltip node document.");
+    return NS_ERROR_FAILURE;
+  }
+  nsCOMPtr<nsIScriptContext> context;
+  nsCOMPtr<nsIScriptGlobalObject> global;
+  document->GetScriptGlobalObject(getter_AddRefs(global));
+  if (global) {
+    if (NS_SUCCEEDED(global->GetContext(getter_AddRefs(context))) && context) {
+      nsCOMPtr<nsIDOMWindowInternal> domWindow = do_QueryInterface(global);
+      if (!domWindow)
+        return NS_ERROR_FAILURE;
+      else {
         PRBool needTooltip;
         targetEl->HasAttribute(NS_LITERAL_STRING("tooltiptext"), &needTooltip);
         if (needTooltip) {
@@ -556,13 +575,6 @@ nsXULTooltipListener::GetTooltipFor(nsIContent* aTarget, nsIContent** aTooltip)
           } else {
             if (!tooltipId.IsEmpty()) {
               // tooltip must be an id, use getElementById to find it
-        nsresult rv;
-        nsCOMPtr<nsIDocument> document;
-        if (NS_FAILED(rv = aTarget->GetDocument(*getter_AddRefs(document)))) {
-          NS_ERROR("Unable to retrieve the tooltip node document.");
-          return rv;
-        }
-
               nsCOMPtr<nsIDOMXULDocument> xulDocument = do_QueryInterface(document);
               if (!xulDocument) {
                 NS_ERROR("tooltip attached to an element that isn't in XUL!");
@@ -589,6 +601,9 @@ nsXULTooltipListener::GetTooltipFor(nsIContent* aTarget, nsIContent** aTooltip)
           mRootBox->GetDefaultTooltip(aTooltip);
           return NS_OK;
         }
+      }
+    }
+  }
 
   return NS_OK;
 }
@@ -616,6 +631,9 @@ nsXULTooltipListener::DestroyTooltip()
     nsCOMPtr<nsIDOMEventTarget> evtTarget(do_QueryInterface(mCurrentTooltip));
     evtTarget->RemoveEventListener(NS_LITERAL_STRING("popuphiding"), (nsIDOMMouseListener*)this, PR_FALSE);
 
+    mCurrentTooltip = nsnull;
+  }
+  
   // kill any ongoing timers
   KillTooltipTimer();
   if (mAutoHideTimer) {
@@ -623,9 +641,6 @@ nsXULTooltipListener::DestroyTooltip()
     mAutoHideTimer = nsnull;
   }
 
-    mCurrentTooltip = nsnull;
-  }
-
   return NS_OK;
 }