223158 - Crash searching from partially loaded bugzilla query with magnifier running [@ nsDocAccessible::HandleMutationEvent]

Status: RESOLVED FIXED

(Core :: Disability Access APIs, defect)

Description

[timeless]

Incident ID      24628251
Stack Signature  nsDocAccessible::HandleMutationEvent f8e236c5
Product ID       MozillaTrunk
Build ID         2003102004
Trigger Time     2003-10-21 14:25:23
Platform         Win32
Operating System Windows NT 5.0 build 2195
Module           accessibility.dll
URL visited      http://bugzilla.mozilla.org/query.cgi?product=Browser
Comments

I pasted AppendStyleRule into the summary field and hit enter Most of the query
page hadn't loaded yet :) Nothing below the product listbox had loaded and iirc
nothing to the right of it had either. Spiffy. I like accessibility crashes. Of
note: Magnifier <Magnify.exe> is running. Stack wanted.
Trigger Reason   Access violation
Source File Name c:/builds/seamonkey/mozilla/accessible/src/base/nsDocAccessible.cpp
Trigger Line No. 1010

Stack Trace

nsDocAccessible::HandleMutationEvent
[c:/builds/seamonkey/mozilla/accessible/src/base/nsDocAccessible.cpp, line 1010]
nsDocAccessible::NodeInserted
[c:/builds/seamonkey/mozilla/accessible/src/base/nsDocAccessible.cpp, line 826]
DispatchToInterface
[c:/builds/seamonkey/mozilla/content/events/src/nsEventListenerManager.cpp, line
129]
nsEventListenerManager::HandleEvent
[c:/builds/seamonkey/mozilla/content/events/src/nsEventListenerManager.cpp, line
1512]
nsXULDocument::HandleDOMEvent
[c:/builds/seamonkey/mozilla/content/xul/document/src/nsXULDocument.cpp, line 1273]
nsXULElement::HandleDOMEvent
[c:/builds/seamonkey/mozilla/content/xul/content/src/nsXULElement.cpp, line 3171]
nsXULElement::HandleDOMEvent
[c:/builds/seamonkey/mozilla/content/xul/content/src/nsXULElement.cpp, line 3164]
nsXULElement::HandleDOMEvent
[c:/builds/seamonkey/mozilla/content/xul/content/src/nsXULElement.cpp, line 3164]
nsXULElement::HandleDOMEvent
[c:/builds/seamonkey/mozilla/content/xul/content/src/nsXULElement.cpp, line 3164]
nsXULElement::HandleDOMEvent
[c:/builds/seamonkey/mozilla/content/xul/content/src/nsXULElement.cpp, line 3164]
nsXULElement::HandleDOMEvent
[c:/builds/seamonkey/mozilla/content/xul/content/src/nsXULElement.cpp, line 3164]
nsXULElement::HandleDOMEvent
[c:/builds/seamonkey/mozilla/content/xul/content/src/nsXULElement.cpp, line 3164]
nsXULElement::HandleDOMEvent
[c:/builds/seamonkey/mozilla/content/xul/content/src/nsXULElement.cpp, line 3164]
nsXULElement::HandleChromeEvent
[c:/builds/seamonkey/mozilla/content/xul/content/src/nsXULElement.cpp, line 4308]
GlobalWindowImpl::HandleDOMEvent
[c:/builds/seamonkey/mozilla/dom/src/base/nsGlobalWindow.cpp, line 842]
nsDocument::HandleDOMEvent
[c:/builds/seamonkey/mozilla/content/base/src/nsDocument.cpp, line 3741]
nsGenericElement::HandleDOMEvent
[c:/builds/seamonkey/mozilla/content/base/src/nsGenericElement.cpp, line 1928]
nsGenericDOMDataNode::HandleDOMEvent
[c:/builds/seamonkey/mozilla/content/base/src/nsGenericDOMDataNode.cpp, line 788]
nsGenericHTMLContainerElement::AppendChildTo
[c:/builds/seamonkey/mozilla/content/html/content/src/nsGenericHTMLElement.cpp,
line 3806]
nsHTMLOptionElement::AppendChildTo
[c:/builds/seamonkey/mozilla/content/html/content/src/nsHTMLOptionElement.cpp,
line 627]
SinkContext::FlushText
[c:/builds/seamonkey/mozilla/content/html/document/src/nsHTMLContentSink.cpp,
line 1968]
SinkContext::FlushTags
[c:/builds/seamonkey/mozilla/content/html/document/src/nsHTMLContentSink.cpp,
line 1820]
HTMLContentSink::FlushPendingNotifications
[c:/builds/seamonkey/mozilla/content/html/document/src/nsHTMLContentSink.cpp,
line 4620]
nsHTMLDocument::FlushPendingNotifications
[c:/builds/seamonkey/mozilla/content/html/document/src/nsHTMLDocument.cpp, line
1531]
nsHTMLDocument::ResolveName
[c:/builds/seamonkey/mozilla/content/html/document/src/nsHTMLDocument.cpp, line
3666]
nsHTMLDocumentSH::ResolveImpl
[c:/builds/seamonkey/mozilla/dom/src/base/nsDOMClassInfo.cpp, line 5230]
nsHTMLDocumentSH::NewResolve
[c:/builds/seamonkey/mozilla/dom/src/base/nsDOMClassInfo.cpp, line 5294]
XPC_WN_Helper_NewResolve
[c:/builds/seamonkey/mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp,
line 909]
js_LookupProperty
[c:/builds/seamonkey/mozilla/js/src/jsobj.c, line 2400]
js_GetProperty
[c:/builds/seamonkey/mozilla/js/src/jsobj.c, line 2588]
js_Interpret
[c:/builds/seamonkey/mozilla/js/src/jsinterp.c, line 2691]
js_Invoke
[c:/builds/seamonkey/mozilla/js/src/jsinterp.c, line 858]
nsXPCWrappedJSClass::CallMethod
[c:/builds/seamonkey/mozilla/js/src/xpconnect/src/xpcwrappedjsclass.cpp, line 1333]
nsXPCWrappedJS::CallMethod
[c:/builds/seamonkey/mozilla/js/src/xpconnect/src/xpcwrappedjs.cpp, line 429]
PrepareAndDispatch
[c:/builds/seamonkey/mozilla/xpcom/reflect/xptcall/src/md/win32/xptcstubs.cpp,
line 119]
SharedStub
[c:/builds/seamonkey/mozilla/xpcom/reflect/xptcall/src/md/win32/xptcstubs.cpp,
line 147]
nsBrowserStatusFilter::OnLocationChange
[c:/builds/seamonkey/mozilla/xpfe/browser/src/nsBrowserStatusFilter.cpp, line 228]
nsDocLoaderImpl::FireOnLocationChange
[c:/builds/seamonkey/mozilla/uriloader/base/nsDocLoader.cpp, line 1252]
nsDocShell::SetCurrentURI
[c:/builds/seamonkey/mozilla/docshell/base/nsDocShell.cpp, line 1329]
nsDocShell::OnNewURI
[c:/builds/seamonkey/mozilla/docshell/base/nsDocShell.cpp, line 6002]
nsDocShell::OnLoadingSite
[c:/builds/seamonkey/mozilla/docshell/base/nsDocShell.cpp, line 6027]
nsDocShell::CreateContentViewer
[c:/builds/seamonkey/mozilla/docshell/base/nsDocShell.cpp, line 4519]
nsDSURIContentListener::DoContent
[c:/builds/seamonkey/mozilla/docshell/base/nsDSURIContentListener.cpp, line 110]
nsDocumentOpenInfo::TryContentListener
[c:/builds/seamonkey/mozilla/uriloader/base/nsURILoader.cpp, line 612]
nsDocumentOpenInfo::DispatchContent
[c:/builds/seamonkey/mozilla/uriloader/base/nsURILoader.cpp, line 384]
nsDocumentOpenInfo::OnStartRequest
[c:/builds/seamonkey/mozilla/uriloader/base/nsURILoader.cpp, line 273]
nsMultiMixedConv::SendStart
[c:/builds/seamonkey/mozilla/netwerk/streamconv/converters/nsMultiMixedConv.cpp,
line 805]
nsMultiMixedConv::OnDataAvailable
[c:/builds/seamonkey/mozilla/netwerk/streamconv/converters/nsMultiMixedConv.cpp,
line 563]
nsDocumentOpenInfo::OnDataAvailable
[c:/builds/seamonkey/mozilla/uriloader/base/nsURILoader.cpp, line 289]
nsStreamListenerTee::OnDataAvailable
[c:/builds/seamonkey/mozilla/netwerk/base/src/nsStreamListenerTee.cpp, line 98]
nsHttpChannel::OnDataAvailable
[c:/builds/seamonkey/mozilla/netwerk/protocol/http/src/nsHttpChannel.cpp, line 3420]
nsInputStreamPump::OnStateTransfer
[c:/builds/seamonkey/mozilla/netwerk/base/src/nsInputStreamPump.cpp, line 436]
nsInputStreamPump::OnInputStreamReady
[c:/builds/seamonkey/mozilla/netwerk/base/src/nsInputStreamPump.cpp, line 337]
nsInputStreamReadyEvent::EventHandler
[c:/builds/seamonkey/mozilla/xpcom/io/nsStreamUtils.cpp, line 211]
PL_HandleEvent
[c:/builds/seamonkey/mozilla/xpcom/threads/plevent.c, line 672]
PL_ProcessPendingEvents
[c:/builds/seamonkey/mozilla/xpcom/threads/plevent.c, line 610]
_md_EventReceiverProc
[c:/builds/seamonkey/mozilla/xpcom/threads/plevent.c, line 1413]
nsAppShellService::Run
[c:/builds/seamonkey/mozilla/xpfe/appshell/src/nsAppShellService.cpp, line 484]
main1
[c:/builds/seamonkey/mozilla/xpfe/bootstrap/nsAppRunner.cpp, line 1302]
main
[c:/builds/seamonkey/mozilla/xpfe/bootstrap/nsAppRunner.cpp, line 1682]
WinMain
[c:/builds/seamonkey/mozilla/xpfe/bootstrap/nsAppRunner.cpp, line 1704]
WinMainCRTStartup()
KERNEL32.DLL + 0x7903 (0x77e87903)

Reproducable: Yes
Talkback: 1/2

 EAX = 00000000 EBX = 00008004 ECX = 00000000
 EDX = 0012D888 ESI = 00000000 EDI = 61DA0E5C
 EIP = 617D5F9A ESP = 0012D88C EBP = 0012D8C8

 995 aaronl  1.9    nsCOMPtr<nsIAccessibleDocument> docAccessible;
 996                GetEventDocAccessible(subTreeToInvalidate,
getter_AddRefs(docAccessible));
 997 aaronl  1.23   nsCOMPtr<nsPIAccessibleDocument> privateDocAccessible =
 998                  do_QueryInterface(docAccessible);
1000 aaronl  1.23  
privateDocAccessible->InvalidateCacheSubtree(subTreeToInvalidate);
1009                nsCOMPtr<nsIAccessible> accessible;
1010 aaronl  1.9    docAccessible->GetAccessibleInParentChain(targetNode,
getter_AddRefs(accessible));

void nsDocAccessible::GetEventDocAccessible(nsIDOMNode *aNode,
nsIAccessibleDocument **aAccessibleDoc)

Does not always out non null. So the crash (which is null pointer) is
dereferencing privateDocAccessible which is equivalent to docAccessible.

Comment 1

[timeless]

Attachment: return if GetEventDocAccessible outs null

Comment 2

[Christopher Aillon (sabbatical, not receiving bugmail)]

Comment on attachment 133810 [details] [diff] [review]
return if GetEventDocAccessible outs null

This seems like its the right thing to do, since GetEventDocAccessible can
legitimately out null.	r=caillon

Comment 3

[Boris Zbarsky [:bzbarsky]]

Comment on attachment 133810 [details] [diff] [review]
return if GetEventDocAccessible outs null

sr=bzbarsky

Comment 4

[timeless]

checked in