746990 - crash in nsXULTreeAccessible::Value

Status: VERIFIED FIXED

(Core :: Disability Access APIs, defect)

Description

[Marco Zehe (:MarcoZ)]

This bug was filed from the Socorro interface and is 
report bp-c7d007a9-42bd-48eb-96a7-0695d2120419 .
============================================================= 
I did the following:
1. Opened Thunderbird.
2. Opened the IM module and logged on to a few IRC channels.
3. Right-clicked one of the IRC channels and selected "Close this conversation".

Note that I had right-clicked the "Nickserv" message conversation before and closed it without incident, so this may not be reproducible at will.

Comment 1

[David Bolter [:davidb] (NeedInfo me for attention)]

It looks like the accessible is alive (probably in doc cache) but has been shutdown, leaving mTreeView nulled out. Meanwhile NVDA is asking for a value and kaboom.

Comment 2

[alexander :surkov (:asurkov)]

(In reply to David Bolter [:davidb] from comment #1)
> It looks like the accessible is alive (probably in doc cache) but has been
> shutdown,

nope

> leaving mTreeView nulled out.

yes

Comment 3

[David Bolter [:davidb] (NeedInfo me for attention)]

How is mTreeView nulled out?

Comment 4

[Trevor Saunders (:tbsaunde)]

(In reply to David Bolter [:davidb] from comment #3)
> How is mTreeView nulled out?

TreViewChanged(), I think the right fix here is just adding a null check.

Comment 5

[David Bolter [:davidb] (NeedInfo me for attention)]

If the tree view changes, shouldn't we destroy the accessible and create a new one?

Comment 6

[David Bolter [:davidb] (NeedInfo me for attention)]

When do tree views change?

Comment 7

[alexander :surkov (:asurkov)]

(In reply to David Bolter [:davidb] from comment #5)
> If the tree view changes, shouldn't we destroy the accessible and create a
> new one?

tree accessible? nope, 'cause treeview is responsible for data, i.e rows

(In reply to David Bolter [:davidb] from comment #6)
> When do tree views change?

when the author changes the tree view.

Comment 8

[alexander :surkov (:asurkov)]

per comment #4, add a mTreeView null check into Value() method

Comment 9

[David Bolter [:davidb] (NeedInfo me for attention)]

(In reply to alexander :surkov from comment #7)
> (In reply to David Bolter [:davidb] from comment #6)
> > When do tree views change?
> 
> when the author changes the tree view.

Heh, I was wondering more about when and how often. I suspect this happens more in tbird.

OK I think I know where this bugs going :)

Comment 10

[alexander :surkov (:asurkov)]

(In reply to David Bolter [:davidb] from comment #9)
> Heh, I was wondering more about when and how often. I suspect this happens
> more in tbird.

sort of strange question because that depends on the author (application) completely. Basically when the tree gets into no-data state then I think the author nulls out the treeview. 

I would suspect that too because tbird UI uses XUL trees a lot.

> OK I think I know where this bugs going :)

where? :)

Comment 11

[Mark Capella [:capella]]

Attachment: Patch (v1)

Quick fix for a "red" bug ... built and tested locally ...

Comment 12

[alexander :surkov (:asurkov)]

Comment on attachment 618877 [details] [diff] [review]
Patch (v1)

thanks for doing this

Comment 13

[alexander :surkov (:asurkov)]

https://hg.mozilla.org/integration/mozilla-inbound/rev/bba6161714f2

Comment 14

[Ryan VanderMeulen [:RyanVM]]

http://hg.mozilla.org/mozilla-central/rev/bba6161714f2

Comment 15

[Wayne Mery (:wsmwk)]

reporter in https://getsatisfaction.com/mozilla_messaging/tags/bug_746990 indicates crash is fixed for thunderbird 15