312792 - Crash exposing dynamically changing <option> lists

Status: VERIFIED FIXED

(Core :: Disability Access APIs, defect)

Description

[Aaron Leventhal]

We're not setting the end of the list correctly when we cache a group of <option>'s.

As a result, options lists can crash when you get next sibling.

Steps to repro:
1. Launch Window-Eyes
2. Go to http://www.creative.com/language.asp
3. Type Ctrl+Shift+A to turn off browse mode
4. Click on the first list
5. Down arrow

Firefox will crash

Comment 1

[Aaron Leventhal]

Attachment: SetNextSibling(nsnull) on the last <option> cached

Comment 2

[Boris Zbarsky [:bzbarsky]]

Comment on attachment 199894 [details] [diff] [review]
SetNextSibling(nsnull) on the last <option> cached

sr=bzbarsky, but I have to confess I have no idea what this code is doing (and
no time to sort it out).

Comment 3

[parente]

Comment on attachment 199894 [details] [diff] [review]
SetNextSibling(nsnull) on the last <option> cached

Do you need to check if the QI succeeds on lastGoodAccessible before using it?

Comment 4

[Aaron Leventhal]

(In reply to comment #3)
> (From update of attachment 199894 [details] [diff] [review] [edit])
> Do you need to check if the QI succeeds on lastGoodAccessible before using it?

No, it will always succeed. We put assertions in sometimes but it will never get
hit.

Comment 5

[Aaron Leventhal]

This has been tested by GW Micro in a special build created for them.

Comment 6

[Dan Kinnunen]

Verified that this has been fixed in dev build 10/18/05 build from aaron.

Comment 7

[Aaron Leventhal]

Verified by Doug Geoffray from GW Micro.