Verified Commit 08795680 authored by Kui-Feng Lee's avatar Kui-Feng Lee Committed by ma1
Browse files

Bug 2058661 - Clear the drag source window's GdkDragContext pointer... 

Bug 2058661 - Clear the drag source window's GdkDragContext pointer synchronously. r=stransky a=RyanVM DONTBUILD

gtk_drag_begin_with_coordinates() returns a borrowed context: GtkDragSourceInfo
holds the only reference, and gtk_drag_source_info_destroy() drops it as soon as
the drag-end handler returns. nsWindow::mSourceDragContext was cleared only from
an async runnable (EndDragSessionMainThread -> EndDragSessionImpl), so between
GTK's unref and that runnable the pointer dangled, and nsWindow::OnUnmap() calls
gtk_drag_cancel() on it. Content can land an unmap in that window with a
window.close() task queued before the drag ended.

EndDragSessionImpl keeps its own clear for drags torn down without a drag-end.

Original Revision: https://phabricator.services.mozilla.com/D315509

Differential Revision: https://phabricator.services.mozilla.com/D319278
parent 1cec2a2f

widget/gtk/nsDragService.cpp

+8 −0
Original line number Diff line number Diff line
@@ -1741,6 +1741,14 @@ void nsDragSession::SourceEndDragSession(GdkDragContext* aContext, 
  LOGDRAGSERVICE("SourceEndDragSession(%p) result %s\n", aContext,

                 kGtkDragResults[aResult]);



  // GTK drops its last reference right after drag-end, so reset ours now.

  //

  // Clearing only from EndDragSessionImpl is not enough (bug 2058661): that

  // runs from an async runnable, by which point the pointer already dangles.

  if (mSourceWindow) {

    mSourceWindow->SetDragSource(nullptr);

  }



  // this just releases the list of data items that we provide

  mSourceDataItems = nullptr;