pacificIT / chromiumembedded

Automatically exported from code.google.com/p/chromiumembedded
0 stars 1 forks source link

Win: Crash when deleting the browser while in the client drag handler #610

Closed GoogleCodeExporter closed 9 years ago

GoogleCodeExporter commented 9 years ago
CEF1 963 branch.
Windows 7 64bit.

What steps will reproduce the problem?
1. Begin dragging from a CEF window.
2. In the client drag handler delete the CEF window.

What is the expected output? What do you see instead?
The drag operation should complete successfully. Instead, CEF crashes in 
WebCore::EventHandler::mouseMoved. The problem can be explained as follows:

1. WebWidgetHost::WndProc receives WM_MOUSEMOVE which calls 
EventHandler::mouseMoved line 1560 which calls the client drag/drop handling.
2. Client drag/drop handling destroys the window which deletes the 
WebWidgetHost and underlying WebKit objects.
3. EventHandler::mouseMoved line 1565 tries to access |m_frame| but the 
EventHandler object has already been deleted.

Original issue reported on code.google.com by magreenb...@gmail.com on 30 May 2012 at 5:25

GoogleCodeExporter commented 9 years ago
Fixed in revision 655 and revision 656 by delaying browser destruction until 
the drag operation has completed.

Original comment by magreenb...@gmail.com on 30 May 2012 at 6:07

GoogleCodeExporter commented 9 years ago
A related crash occurs on OS-X 10.6. Revision 663 and revision 664 fixes that 
crash.

Original comment by magreenb...@gmail.com on 1 Jun 2012 at 6:44