207554 - Crash nsHTMLSelectOptionAccessible::GetAccNextSibling()

Status: RESOLVED FIXED

(Core :: Disability Access APIs, defect)

Description

[Aaron Leventhal]

If there is no parent, it crashes when it tries to use mParent->GetAccDOMNode().


Incident ID:    
Incident ID 20543829
Stack Signature 	nsHTMLSelectOptionAccessible::GetAccNextSibling 7374260d
Email Address 	[e-mail]
Product ID 	MozillaTrunk
Build ID 	2003052204
Trigger Time 	2003-05-29 04:44:12
Platform 	Win32
Operating System 	Windows NT 5.0 build 2195
Module 	accessibility.dll
URL visited 	c:\aaron\test\controls.html
User Comments 	Ctrl+R to reload page
Trigger Reason 	Access violation
Source File Name 
c:/builds/seamonkey/mozilla/accessible/src/html/nsHTMLSelectAccessible.cpp
Trigger Line No. 	493
Stack Trace 	
nsHTMLSelectOptionAccessible::GetAccNextSibling
[c:/builds/seamonkey/mozilla/accessible/src/html/nsHTMLSelectAccessible.cpp,
line 493]
nsAccessible::Shutdown
[c:/builds/seamonkey/mozilla/accessible/src/base/nsAccessible.cpp, line 220]
nsAccessNode::ClearCacheEntry
[c:/builds/seamonkey/mozilla/accessible/src/base/nsAccessNode.cpp, line 313]
hashEnumerate [c:/builds/seamonkey/mozilla/xpcom/ds/nsHashtable.cpp, line 121]
PL_DHashTableEnumerate [c:/builds/seamonkey/mozilla/xpcom/ds/pldhash.c, line 595]
nsHashtable::Enumerate [c:/builds/seamonkey/mozilla/xpcom/ds/nsHashtable.cpp,
line 304]
nsAccessNode::ClearCache
[c:/builds/seamonkey/mozilla/accessible/src/base/nsAccessNode.cpp, line 319]
nsDocAccessible::Shutdown
[c:/builds/seamonkey/mozilla/accessible/src/base/nsDocAccessible.cpp, line 390]
nsDocAccessible::Destroy
[c:/builds/seamonkey/mozilla/accessible/src/base/nsDocAccessible.cpp, line 358]
nsWindow::~nsWindow
[c:/builds/seamonkey/mozilla/widget/src/windows/nsWindow.cpp, line 824]
nsWindow::`scalar deleting destructor'
nsWindow::Release [c:/builds/seamonkey/mozilla/widget/src/windows/nsWindow.cpp,
line 699]
nsCOMPtr_base::~nsCOMPtr_base
[c:/builds/seamonkey/mozilla/xpcom/glue/nsCOMPtr.cpp, line 66]
DocumentViewerImpl::~DocumentViewerImpl
[c:/builds/seamonkey/mozilla/content/base/src/nsDocumentViewer.cpp, line 564]
DocumentViewerImpl::Release
[c:/builds/seamonkey/mozilla/content/base/src/nsDocumentViewer.cpp, line 531]
nsCOMPtr_base::~nsCOMPtr_base
[c:/builds/seamonkey/mozilla/xpcom/glue/nsCOMPtr.cpp, line 66]
DocumentViewerImpl::Show
[c:/builds/seamonkey/mozilla/content/base/src/nsDocumentViewer.cpp, line 1370]
PresShell::UnsuppressAndInvalidate
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsPresShell.cpp, line 4946]
PresShell::UnsuppressPainting
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsPresShell.cpp, line 4993]
DocumentViewerImpl::LoadComplete
[c:/builds/seamonkey/mozilla/content/base/src/nsDocumentViewer.cpp, line 960]
nsDocShell::EndPageLoad
[c:/builds/seamonkey/mozilla/docshell/base/nsDocShell.cpp, line 4334]
nsWebShell::EndPageLoad
[c:/builds/seamonkey/mozilla/docshell/base/nsWebShell.cpp, line 881]
nsDocShell::OnStateChange
[c:/builds/seamonkey/mozilla/docshell/base/nsDocShell.cpp, line 4268]
nsDocLoaderImpl::FireOnStateChange
[c:/builds/seamonkey/mozilla/uriloader/base/nsDocLoader.cpp, line 1214]
nsDocLoaderImpl::doStopDocumentLoad
[c:/builds/seamonkey/mozilla/uriloader/base/nsDocLoader.cpp, line 869]
nsDocLoaderImpl::DocLoaderIsEmpty
[c:/builds/seamonkey/mozilla/uriloader/base/nsDocLoader.cpp, line 767]
nsDocLoaderImpl::OnStopRequest
[c:/builds/seamonkey/mozilla/uriloader/base/nsDocLoader.cpp, line 697]
nsLoadGroup::RemoveRequest
[c:/builds/seamonkey/mozilla/netwerk/base/src/nsLoadGroup.cpp, line 703]
PresShell::RemoveDummyLayoutRequest
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsPresShell.cpp, line 6921]
PresShell::ProcessReflowCommands
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsPresShell.cpp, line 6736]
ReflowEvent::HandleEvent
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsPresShell.cpp, line 6524]
PL_HandleEvent [c:/builds/seamonkey/mozilla/xpcom/threads/plevent.c, line 660]
PL_ProcessPendingEvents [c:/builds/seamonkey/mozilla/xpcom/threads/plevent.c,
line 596]
nsEventQueueImpl::ProcessPendingEvents
[c:/builds/seamonkey/mozilla/xpcom/threads/nsEventQueue.cpp, line 391]
0x18a16457

Comment 1

[Aaron Leventhal]

Attachment: Return early if mParent is null. Also, use cached next sibling if it exists

Comment 2

[Kyle Yuan]

Comment on attachment 124499 [details] [diff] [review]
Return early if mParent is null. Also, use cached next sibling if it exists

r=kyle

Comment 3

[Alec Flett]

Comment on attachment 124499 [details] [diff] [review]
Return early if mParent is null. Also, use cached next sibling if it exists

sr=alecf

Comment 4

[Aaron Leventhal]

checked in

Comment 5

[Aaron Leventhal]

Comment on attachment 124499 [details] [diff] [review]
Return early if mParent is null. Also, use cached next sibling if it exists

Seeking a= for accessibility patch that has baked on the trunk for 2 weeks.

Comment 6

[Asa Dotzler [:asa]]

Comment on attachment 124499 [details] [diff] [review]
Return early if mParent is null. Also, use cached next sibling if it exists

moving approval request forward.

Comment 7

[Mike Kaply [:mkaply]]

Comment on attachment 124499 [details] [diff] [review]
Return early if mParent is null. Also, use cached next sibling if it exists

a=mkaply

Comment 8

[Mike Kaply [:mkaply]]

please add fixed1.4.1 keyword when checked in.

Comment 9

[Robert Pollak]

According to Bonsai, this patch is not checked in for 1.4.1.
It seems Aaron does not want to do this (see bug 207171 comment 10).

Comment 10

[Mike Kaply [:mkaply]]

I'll leave the approval set. Approval was asked for and given.