Fix two issues in nsIFrame::HandleRelease.

The frame selection changes can run script, so we need to check for the frame itself getting destroyed. This fixes the crash as reported. Additionally, the document check it does for pointer capture is incorrect, it should use the composed, not uncomposed doc, so that it works in shadow dom. Differential Revision: https://phabricator.services.mozilla.com/D87097 bugzilla-url: https://bugzilla.mozilla.org/show_bug.cgi?id=1386418 gecko-commit: e140c6cd2eb944579ec99458638879c9b8501920 gecko-integration-branch: autoland gecko-reviewers: dholbert
valerioadm · Aug 15, 2020 · 12d66ce · 12d66ce
1 parent 8cdb753
commit 12d66ce
Showing 1 changed file with 32 additions and 0 deletions.
diff --git a/input-events/select-event-drag-remove.html b/input-events/select-event-drag-remove.html
@@ -0,0 +1,32 @@
+<!doctype html>
+<meta charset="utf-8">
+<title>Drag select triggers the right event, and doesn't crash if it removes the target while at it</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/resources/testdriver.js"></script>
+<script src="/resources/testdriver-vendor.js"></script>
+<script src="/resources/testdriver-actions.js"></script>
+<link rel="help" href="https://bugzilla.mozilla.org/show_bug.cgi?id=1386418">
+<style>
+  input {
+    border: 0;
+    padding: 0;
+    font: 16px/1 monospace;
+  }
+</style>
+<input type="text" value="Drag select to crash">
+<script>
+async_test(t => {
+  let input = document.querySelector("input");
+  input.addEventListener("select", t.step_func(function() {
+    input.remove();
+    requestAnimationFrame(() => requestAnimationFrame(() => t.done()));
+  }));
+  new test_driver.Actions()
+      .pointerMove(0, 0, { origin: input })
+      .pointerDown()
+      .pointerMove(40, 0, { origin: input })
+      .pointerUp()
+      .send();
+}, "Drag and remove from the select event doesn't crash");
+</script>