757440 - crash in nsHTMLTableAccessible::ColCount or nsHTMLTableAccessible::RowCount with JAWS 11

Status: RESOLVED FIXED

(Core :: Disability Access APIs, defect)

Description

[Scoobidiver (away)]

It's a low volume crash that first appeared in 15.0a1/20120502.

Signature 	nsHTMLTableAccessible::ColCount() More Reports Search
UUID	acb03ae3-dcd5-4c9d-81ea-9c9282120522
Date Processed	2012-05-22 10:04:26
Uptime	196
Last Crash	3.5 minutes before submission
Install Age	18.9 hours since version was first installed.
Install Time	2012-05-21 15:12:45
Product	Firefox
Version	15.0a1
Build ID	20120521030525
Release Channel	nightly
OS	Windows NT
OS Version	6.1.7601 Service Pack 1
Build Architecture	x86
Build Architecture Info	GenuineIntel family 6 model 26 stepping 4
Crash Reason	EXCEPTION_ACCESS_VIOLATION_READ
Crash Address	0x0
App Notes 	
AdapterVendorID: 0x1002, AdapterDeviceID: 0x9440, AdapterSubsysID: 20071787, AdapterDriverVersion: 8.961.0.0
D2D? D2D+ DWrite? DWrite+ D3D10 Layers? D3D10 Layers+ 
EMCheckCompatibility	True
Total Virtual Memory	2147352576
Available Virtual Memory	1700417536
System Memory Use Percentage	28
Available Page File	4964229120
Available Physical Memory	2304339968

Frame 	Module 	Signature 	Source
0 	xul.dll 	nsHTMLTableAccessible::ColCount 	accessible/src/html/nsHTMLTableAccessible.cpp:572
1 	xul.dll 	xpcAccessibleTable::GetColumnCount 	accessible/src/xpcom/xpcAccessibleTable.cpp:33
2 	xul.dll 	mozilla::a11y::ARIAGridAccessible::GetColumnCount 	accessible/src/xul/nsXULTreeGridAccessible.h:61
3 	xul.dll 	nsHTMLTableAccessible::IsProbablyLayoutTable 	accessible/src/html/nsHTMLTableAccessible.cpp:1453
4 	xul.dll 	nsHTMLTableAccessible::GetAttributesInternal 	accessible/src/html/nsHTMLTableAccessible.cpp:525
5 	xul.dll 	nsAccessible::GetAttributes 	accessible/src/base/nsAccessible.cpp:1288
6 	xul.dll 	nsAccessibleWrap::get_attributes 	accessible/src/msaa/nsAccessibleWrap.cpp:1530
7 	FSDomNodeFirefox.DLL 	FSDomNodeFirefox.DLL@0x94f7 	
8 	FSDomNodeFirefox.DLL 	FSDomNodeFirefox.DLL@0xcafb 	
9 	FSDomNodeFirefox.DLL 	FSDomNodeFirefox.DLL@0xd748 	
10 	FSDomNodeFirefox.DLL 	FSDomNodeFirefox.DLL@0xe10f 	
11 	FSDomNodeFirefox.DLL 	FSDomNodeFirefox.DLL@0x1a08 	
12 	FSDomNodeFirefox.DLL 	FSDomNodeFirefox.DLL@0x61ed 	
13 	FsDomSrv.dll 	FsDomSrv.dll@0x1f6ef 	
14 	FsDomSrv.dll 	FsDomSrv.dll@0x1c97e 	
15 	user32.dll 	__ClientCallWinEventProc 	
16 	ntdll.dll 	KiUserCallbackDispatcher 	
17 	ntdll.dll 	KiUserApcDispatcher 	
18 	xul.dll 	nsINode::GetCurrentDoc 	obj-firefox/dist/include/nsINode.h:486
19 	xul.dll 	PL_DHashTableOperate 	obj-firefox/xpcom/build/pldhash.cpp:621
20 	jhook.dll 	jhook.dll@0x56975 	
21 		@0x6c6253 	
22 	xul.dll 	nsAccessible::HandleAccEvent 	accessible/src/base/nsAccessible.cpp:1241
23 	xul.dll 	nsObserverService::EnumerateObservers 	xpcom/ds/nsObserverService.cpp:163
24 	xul.dll 	nsCOMPtr_base::~nsCOMPtr_base 	obj-firefox/dist/include/nsAutoPtr.h:908
25 	xul.dll 	xul.dll@0xdcee83 	
26 	xul.dll 	nsAccessibleWrap::HandleAccEvent 	accessible/src/msaa/nsAccessibleWrap.cpp:1613
27 	xul.dll 	nsEventShell::FireEvent 	accessible/src/base/nsEventShell.cpp:63
28 	xul.dll 	nsDocAccessible::ProcessPendingEvent 	accessible/src/base/nsDocAccessible.cpp:1777
29 	xul.dll 	NotificationController::WillRefresh 	accessible/src/base/NotificationController.cpp:341
30 	xul.dll 	nsRefreshDriver::Notify 	layout/base/nsRefreshDriver.cpp:368
31 	xul.dll 	nsTimerImpl::Fire 	xpcom/threads/nsTimerImpl.cpp:511
32 	xul.dll 	nsTimerEvent::Run 	xpcom/threads/nsTimerImpl.cpp:591
33 	xul.dll 	nsThread::ProcessNextEvent 	xpcom/threads/nsThread.cpp:656
...

More reports at:
https://crash-stats.mozilla.com/report/list?signature=nsHTMLTableAccessible%3A%3AColCount%28%29

Comment 1

[David Bolter [:davidb] (NeedInfo me for attention)]

A tablelayout check was removed in bug 739882.

Comment 2

[David Bolter [:davidb] (NeedInfo me for attention)]

We should also add back a check to RowCount while here methinks.

Comment 3

[David Bolter [:davidb] (NeedInfo me for attention)]

Attachment: fix - reinstate tablelayout checks

Comment 4

[David Bolter [:davidb] (NeedInfo me for attention)]

https://hg.mozilla.org/integration/mozilla-inbound/rev/41969fb22ac1

Comment 5

[Scoobidiver (away)]

(In reply to David Bolter [:davidb] from comment #2)
> We should also add back a check to RowCount while here methinks.
You're right. See https://crash-stats.mozilla.com/report/list?signature=nsHTMLTableAccessible%3A%3ARowCount%28%29

Comment 6

[David Bolter [:davidb] (NeedInfo me for attention)]

(In reply to Scoobidiver from comment #5)
> (In reply to David Bolter [:davidb] from comment #2)
> > We should also add back a check to RowCount while here methinks.
> You're right. See
> https://crash-stats.mozilla.com/report/
> list?signature=nsHTMLTableAccessible%3A%3ARowCount%28%29

Thanks Scoob (we also added this fix in the existing patch).

Comment 7

[Ed Morley [:emorley]]

https://hg.mozilla.org/mozilla-central/rev/41969fb22ac1