377535 - Crash [@ nsLinkableAccessible::CacheActionContent] with appending area and strange prefix

Status: RESOLVED FIXED

(Core :: Disability Access APIs, defect)

Description

[Martijn Wargers (dead)]

The testcase uses enhanced privileges, so you need to download it to your computer to get the crash.
It also crashes a recent 1.8 branch build.

Talkback ID: TB31199479H
nsLinkableAccessible::CacheActionContent  [mozilla/accessible/src/base/nsbasewidgetaccessible.cpp, line 250]
nsLinkableAccessible::Init  [mozilla/accessible/src/base/nsbasewidgetaccessible.cpp, line 286]
nsAccessibilityService::GetAccessible  [mozilla/accessible/src/base/nsaccessibilityservice.cpp, line 1175]
nsThreadManager::GetIsMainThread  [mozilla/xpcom/threads/nsthreadmanager.cpp, line 279]

Comment 1

[Martijn Wargers (dead)]

Attachment: testcase

Comment 2

[Mats Palmgren (inactive)]

Attachment: stack

Comment 3

[Mats Palmgren (inactive)]

Attachment: Patch rev. 1

Comment 4

[Mats Palmgren (inactive)]

Attachment: Patch rev. 1 (diff -w)

Comment 5

[Aaron Leventhal]

Comment on attachment 261594 [details] [diff] [review]
Patch rev. 1 (diff -w)

Mats, can yo udescribe what kind of object is <a> or <area> that is not nsILink?

Comment 6

[Mats Palmgren (inactive)]

Attachment: Patch rev. 2 (diff -w)

(In reply to comment #5)
> (From update of attachment 261594 [details] [diff] [review])
> Mats, can yo udescribe what kind of object is <a> or <area> that is not
> nsILink?

An element that isn't [X]HTML.  Now that I think about it, we should check
that before trying QI (it's how we do it in other places in the code).

Same patch as before with the addtion to the if-condition:
        walkUpContent->IsNodeOfType(nsINode::eHTML)

Comment 7

[Aaron Leventhal]

Comment on attachment 262262 [details] [diff] [review]
Patch rev. 2 (diff -w)

Something about the line breaks --  this patch is unreadable.

Comment 8

[Mats Palmgren (inactive)]

Comment on attachment 262262 [details] [diff] [review]
Patch rev. 2 (diff -w)

I forgot to click the Patch checkbox, sorry.

Comment 9

[Mats Palmgren (inactive)]

Checked in to trunk at 2007-05-06 02:03	PDT.

-> FIXED

Comment 10

[Daniel Veditz [:dveditz]]

Don't need to block on a null deref, but will approve the patch if you want to land it on the branch.

Comment 11

[juan becerra [:juanb]]

Comment on attachment 262262 [details] [diff] [review]
Patch rev. 2 (diff -w)

approved for 1.8.1.5, a=juanb for release-drivers

Comment 12

[Mats Palmgren (inactive)]

Comment on attachment 262262 [details] [diff] [review]
Patch rev. 2 (diff -w)

This patch does not apply to branches.

Comment 13

[Mats Palmgren (inactive)]

Attachment: Patch rev. 2.1 (for branches)

Comment 14

[Mats Palmgren (inactive)]

Attachment: Patch rev. 2.1 (for branches) (diff -w)

This makes nsLinkableAccessible::CacheActionContent() up-to-date with
the trunk version.  Notice the added 'break;'s.

I can't crash branch builds on Linux on the testcase without the patch,
although I suspect there could be a way to do it given the similarity
of the code.  Aaron, do you still want this for branches?

Comment 15

[Daniel Veditz [:dveditz]]

Comment on attachment 270504 [details] [diff] [review]
Patch rev. 2.1 (for branches) (diff -w)

approved for 1.8.1.7, a=dveditz for release-drivers

Comment 16

[Mats Palmgren (inactive)]

MOZILLA_1_8_BRANCH
mozilla/accessible/src/base/nsBaseWidgetAccessible.cpp 	1.38.2.5 

Comment 17

[Carsten Book [:Tomcat]]

verified fixed 1.8.1.7 using : Mozilla/5.0 (Windows; U; Windows NT 5.2; en-US; rv:1.8.1.7pre) Gecko/2007091303 BonEcho/2.0.0.7pre and Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8.1.7pre) Gecko/2007091303 BonEcho/2.0.0.7pre (Fedora F7) 

no crash the steps to reproduce - local testcase 

-> adding verified keyword