Bug 299384, Crash in Mac Carbon nsNativeScrollbar::DoScrollAction when using the scrollbar while reloading since 282940. Handle Destroy() when the page is going away. r=josh sr=smfr a=asa

widget/src/mac/nsNativeScrollbar.cpp

@@ -118,6 +118,22 @@ nsNativeScrollbar::~nsNativeScrollbar()
 
 
 
+//
+// Destroy
+//
+// Now you're gone, gone, gone, whoa-oh...
+//
+NS_IMETHODIMP
+nsNativeScrollbar::Destroy()
+{
+  if (mMouseDownInScroll)
+  {
+    PostEvent(mouseUp, 0);
+  }
+  return nsMacControl::Destroy();
+}
+
+
 //
 // ScrollActionProc
 //
@@ -146,6 +162,19 @@ nsNativeScrollbar::DoScrollAction(ControlPartCode part)
   PRUint32 oldPos, newPos;
   PRUint32 incr;
   PRUint32 visibleImageSize;
+
+  if (mOnDestroyCalled)
+    return;
+
+  nsCOMPtr<nsIWidget> parent ( dont_AddRef(GetParent()) );
+  if (!parent)
+  {
+    // parent disappeared while scrolling was in progress.  Handling Destroy
+    // should have prevented this.  Bail out.
+    NS_ASSERTION(parent, "no parent in DoScrollAction");
+    return;
+  }
+
   GetPosition(&oldPos);
   GetLineIncrement(&incr);
   GetViewSize(&visibleImageSize);
@@ -228,7 +257,6 @@ nsNativeScrollbar::DoScrollAction(ControlPartCode part)
   // we may be in a tight loop, we need to manually validate the area
   // we just updated so the update rect doesn't continue to get bigger
   // and bigger the more we scroll.
-  nsCOMPtr<nsIWidget> parent ( dont_AddRef(GetParent()) );
   parent->Update();
   parent->Validate();
 
@@ -288,6 +316,7 @@ nsNativeScrollbar::DispatchMouseEvent(nsMouseEvent &aEvent)
   {
     case NS_MOUSE_LEFT_DOUBLECLICK:
     case NS_MOUSE_LEFT_BUTTON_DOWN:
+      mMouseDownInScroll = PR_TRUE;
       NS_ASSERTION(this != 0, "NULL nsNativeScrollbar2");
       ::SetControlReference(mControl, (UInt32) this);
       StartDraw();
@@ -328,6 +357,7 @@ nsNativeScrollbar::DispatchMouseEvent(nsMouseEvent &aEvent)
 
 
     case NS_MOUSE_LEFT_BUTTON_UP:
+      mMouseDownInScroll = PR_FALSE;
       mClickedPartCode = 0;
       break;
 

widget/src/mac/nsNativeScrollbar.h

@@ -1,104 +0,0 @@
-/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
-/* ***** BEGIN LICENSE BLOCK *****
- * Version: MPL 1.1/GPL 2.0/LGPL 2.1
- *
- * The contents of this file are subject to the Mozilla Public License
- * Version 1.1 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- * http://www.mozilla.org/MPL/
- *
- * Software distributed under the License is distributed on an "AS IS" basis,
- * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
- * for the specific language governing rights and limitations under the
- * License.
- *
- * The Original Code is mozilla.org code.
- *
- * The Initial Developer of the Original Code is 
- * Netscape Communications Corporation.
- * Portions created by the Initial Developer are Copyright (C) 2002
- * the Initial Developer. All Rights Reserved.
- *
- * Contributor(s):
- *
- * Alternatively, the contents of this file may be used under the terms of
- * either the GNU General Public License Version 2 or later (the "GPL"), or 
- * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
- * in which case the provisions of the GPL or the LGPL are applicable instead
- * of those above. If you wish to allow use of your version of this file only
- * under the terms of either the GPL or the LGPL, and not to allow others to
- * use your version of this file under the terms of the MPL, indicate your
- * decision by deleting the provisions above and replace them with the notice
- * and other provisions required by the GPL or the LGPL. If you do not delete
- * the provisions above, a recipient may use your version of this file under
- * the terms of any one of the NPL, the GPL or the LGPL.
- *
- * ***** END LICENSE BLOCK ***** */
-
-
-#ifndef nsNativeScrollbar_h__
-#define nsNativeScrollbar_h__
-
-#include "nsMacControl.h"
-#include "nsINativeScrollbar.h"
-#include <Controls.h>
-#include "nsIContent.h"
-
-class nsIScrollbarMediator;
-
-
-//
-// nsNativeScrollbar
-//
-// A wrapper around a MacOS native scrollbar that knows how to work
-// with a stub gecko frame to scroll in the GFXScrollFrame mechanism
-//
-
-
-class nsNativeScrollbar : public nsMacControl, public nsINativeScrollbar
-{
-private:
-  typedef nsMacControl Inherited;
-
-public:
-                nsNativeScrollbar();
-  virtual       ~nsNativeScrollbar();
-  
-  NS_DECL_ISUPPORTS_INHERITED
-  NS_DECL_NSINATIVESCROLLBAR
-
-protected:
-
-  // nsWindow Interface
-  virtual PRBool DispatchMouseEvent(nsMouseEvent &aEvent);
-  
-  virtual ControlPartCode GetControlHiliteState();
-
-  ControlHandle   GetControl() { return mControl; }
-  
-  void UpdateContentPosition(PRUint32 inNewPos);
-
-private:
-
-  friend class StNativeControlActionProcOwner;
-  
-  static pascal void ScrollActionProc(ControlHandle, ControlPartCode);
-  void DoScrollAction(ControlPartCode);
-
-// DATA
-private:
-
-  nsIContent*       mContent;          // the content node that affects the scrollbar's value
-  nsIScrollbarMediator* mMediator;     // for scrolling with outliners
-  nsISupports*      mScrollbar;        // for calling into the mediator
-  
-  PRUint32          mMaxValue;
-  PRUint32          mVisibleImageSize;
-  PRUint32          mLineIncrement;
-  PRBool            mMouseDownInScroll;
-  ControlPartCode   mClickedPartCode;
-};
-
-
-
-#endif // nsNativeScrollbar_

widget/src/mac/nsWindow.cpp

@@ -272,7 +272,6 @@ nsWindow::nsWindow() : nsBaseWidget() , nsDeleteObserved(this), nsIKBStateContro
   mVisRegion = nsnull;
   mWindowPtr = nsnull;
   mDrawing = PR_FALSE;
-  mDestroyCalled = PR_FALSE;
   mDestructorCalled = PR_FALSE;
 
   SetBackgroundColor(NS_RGB(255, 255, 255));
@@ -418,9 +417,9 @@ NS_IMETHODIMP nsWindow::Create(nsNativeWidget aNativeParent,		// this is a nsWin
 //-------------------------------------------------------------------------
 NS_IMETHODIMP nsWindow::Destroy()
 {
-	if (mDestroyCalled)
+	if (mOnDestroyCalled)
 		return NS_OK;
-	mDestroyCalled = PR_TRUE;
+	mOnDestroyCalled = PR_TRUE;
 
 	nsBaseWidget::OnDestroy();
 	nsBaseWidget::Destroy();
@@ -1112,7 +1111,7 @@ inline PRUint16 COLOR8TOCOLOR16(PRUint8 color8)
 //-------------------------------------------------------------------------
 void nsWindow::StartDraw(nsIRenderingContext* aRenderingContext)
 {
-	if (mDrawing)
+	if (mDrawing || mOnDestroyCalled)
 		return;
 	mDrawing = PR_TRUE;
 
@@ -1167,7 +1166,7 @@ void nsWindow::StartDraw(nsIRenderingContext* aRenderingContext)
 //-------------------------------------------------------------------------
 void nsWindow::EndDraw()
 {
-	if (! mDrawing)
+	if (! mDrawing || mOnDestroyCalled)
 		return;
 	mDrawing = PR_FALSE;
 

widget/src/mac/nsWindow.h

@@ -267,7 +267,6 @@ protected:
   RgnHandle         mVisRegion;
   WindowPtr         mWindowPtr;
 
-  PRPackedBool      mDestroyCalled;
   PRPackedBool      mDestructorCalled;
 
   PRPackedBool      mAcceptFocusOnClick;

widget/src/xpwidgets/nsBaseWidget.cpp

@@ -602,6 +602,9 @@ nsIRenderingContext* nsBaseWidget::GetRenderingContext()
   nsresult                      rv;
   nsCOMPtr<nsIRenderingContext> renderingCtx;
 
+  if (mOnDestroyCalled)
+    return nsnull;
+
   rv = mContext->CreateRenderingContextInstance(*getter_AddRefs(renderingCtx));
   if (NS_SUCCEEDED(rv)) {
     rv = renderingCtx->Init(mContext, this);