From ef85b7987c4ece02283abe04dbe791065d77c8f5 Mon Sep 17 00:00:00 2001
From: "Olli.Pettay%helsinki.fi"
 <Olli.Pettay%helsinki.fi@18797224-902f-48f8-a5cc-f745e15eee43>
Date: Mon, 15 May 2006 17:31:28 +0000
Subject: [PATCH] Bug 337520, Crash when window gets destroyed during mouseover
 event, r+sr=bz

git-svn-id: svn://10.0.0.236/trunk@196543 18797224-902f-48f8-a5cc-f745e15eee43
---
 .../events/src/nsEventStateManager.cpp        | 39 ++++++++++++++++---
 1 file changed, 33 insertions(+), 6 deletions(-)

diff --git a/mozilla/content/events/src/nsEventStateManager.cpp b/mozilla/content/events/src/nsEventStateManager.cpp
index 57e8dad8ec6..95eaa2ef499 100644
--- a/mozilla/content/events/src/nsEventStateManager.cpp
+++ b/mozilla/content/events/src/nsEventStateManager.cpp
@@ -2545,6 +2545,29 @@ nsEventStateManager::AfterDispatchEvent()
   }
 }
 
+class nsESMEventCB : public nsDispatchingCallback
+{
+public:
+  nsESMEventCB(nsIContent* aTarget) : mTarget(aTarget) {}
+
+  virtual void HandleEvent(nsEventChainPostVisitor& aVisitor)
+  {
+    if (aVisitor.mPresContext) {
+      nsIPresShell* shell = aVisitor.mPresContext->GetPresShell();
+      if (shell) {
+        nsIFrame* frame = shell->GetPrimaryFrameFor(mTarget);
+        if (frame) {
+          frame->HandleEvent(aVisitor.mPresContext,
+                             (nsGUIEvent*) aVisitor.mEvent,
+                             &aVisitor.mEventStatus);
+        }
+      }
+    }
+  }
+
+  nsCOMPtr<nsIContent> mTarget;
+};
+
 nsIFrame*
 nsEventStateManager::DispatchMouseEvent(nsGUIEvent* aEvent, PRUint32 aMessage,
                                         nsIContent* aTargetContent,
@@ -2566,18 +2589,22 @@ nsEventStateManager::DispatchMouseEvent(nsGUIEvent* aEvent, PRUint32 aMessage,
   BeforeDispatchEvent();
   nsIFrame* targetFrame = nsnull;
   if (aTargetContent) {
+    nsESMEventCB callback(aTargetContent);
     nsEventDispatcher::Dispatch(aTargetContent, mPresContext, &event, nsnull,
-                                &status);
+                                &status, &callback);
 
-    nsIPresShell *shell = mPresContext->GetPresShell();
+    nsIPresShell *shell = mPresContext ? mPresContext->GetPresShell() : nsnull;
     if (shell) {
+      // Although the primary frame was checked in event callback, 
+      // it may not be the same object after event dispatching and handling.
+      // So we need to refetch it.
       targetFrame = shell->GetPrimaryFrameFor(aTargetContent);
+      if (targetFrame) {
+        SetFrameExternalReference(targetFrame);
+      }
     }
   }
-  if (targetFrame) {
-    targetFrame->HandleEvent(mPresContext, &event, &status);
-    SetFrameExternalReference(targetFrame);
-  }
+
   AfterDispatchEvent();
 
   mCurrentTargetContent = nsnull;