765195 - crash in nsXULTreeAccessible::TreeViewInvalidated

Status: RESOLVED FIXED

(Core :: Disability Access APIs, defect)

Description

[Scoobidiver (away)]

There are 26 crashes in 14.0b6.

Signature 	nsXULTreeAccessible::TreeViewInvalidated(int, int, int, int) More Reports Search
UUID	4a0ff026-a8ca-422f-bfc0-6e1ad2120612
Date Processed	2012-06-12 00:12:44
Uptime	293
Last Crash	6.4 weeks before submission
Install Age	1.4 days since version was first installed.
Install Time	2012-06-10 15:46:37
Product	Firefox
Version	16.0a1
Build ID	20120606030528
Release Channel	nightly
OS	Windows NT
OS Version	6.1.7601 Service Pack 1
Build Architecture	x86
Build Architecture Info	AuthenticAMD family 21 model 1 stepping 2
Crash Reason	EXCEPTION_ACCESS_VIOLATION_READ
Crash Address	0x0
App Notes 	
AdapterVendorID: 0x1002, AdapterDeviceID: 0x68bf, AdapterSubsysID: 23131787, AdapterDriverVersion: 8.902.0.0
D2D? D2D+ DWrite? DWrite+ D3D10 Layers? D3D10 Layers+ 
EMCheckCompatibility	True
Total Virtual Memory	4294836224
Available Virtual Memory	3855130624
System Memory Use Percentage	26
Available Page File	14725218304
Available Physical Memory	6277373952

Frame 	Module 	Signature 	Source
0 	xul.dll 	nsXULTreeAccessible::TreeViewInvalidated 	accessible/src/xul/nsXULTreeAccessible.cpp:615
1 	xul.dll 	mozilla::a11y::RootAccessible::HandleTreeInvalidatedEvent 	accessible/src/generic/RootAccessible.cpp:734
2 	xul.dll 	mozilla::a11y::RootAccessible::ProcessDOMEvent 	accessible/src/generic/RootAccessible.cpp:335
3 	xul.dll 	TNotification<DocAccessible,nsIContent>::Process 	accessible/src/base/NotificationController.h:64
4 	xul.dll 	NotificationController::WillRefresh 	accessible/src/base/NotificationController.cpp:284
5 	xul.dll 	nsRefreshDriver::Notify 	layout/base/nsRefreshDriver.cpp:336
6 	xul.dll 	nsTimerImpl::Fire 	xpcom/threads/nsTimerImpl.cpp:476
7 	nspr4.dll 	nspr4.dll@0x8c0f 	
8 	xul.dll 	nsTimerEvent::Run 	xpcom/threads/nsTimerImpl.cpp:556
9 	xul.dll 	nsThread::ProcessNextEvent 	xpcom/threads/nsThread.cpp:624
10 	nspr4.dll 	_MD_CURRENT_THREAD 	nsprpub/pr/src/md/windows/w95thred.c:276
11 	xul.dll 	mozilla::ipc::MessagePump::Run 	ipc/glue/MessagePump.cpp:113
12 	xul.dll 	MessageLoop::RunHandler 	ipc/chromium/src/base/message_loop.cc:201
13 	xul.dll 	nsXPCWrappedJSClass::nsXPCWrappedJSClass 	js/xpconnect/src/XPCWrappedJSClass.cpp:170
14 	xul.dll 	nsAppShell::Run 	widget/windows/nsAppShell.cpp:232

More reports at:
https://crash-stats.mozilla.com/report/list?signature=nsXULTreeAccessible%3A%3ATreeViewInvalidated%28int%2C+int%2C+int%2C+int%29

Comment 1

[Marco Zehe (:MarcoZ)]

CC'ing Trevor and Mark, since both were involved in recent code reorg stuff in that area.

Comment 2

[Mark Capella [:capella]]

XULTreeAccessible::TreeViewInvalidated(), and XULTreeItemAccessibleBase::GroupPosition() look like last two methods without mTreeView checks after we added one for bug 757203 into XULTreeAccessible::InvalidateCache() ...

Possible fix? Os is this over-simplistic?

Comment 3

[Trevor Saunders (:tbsaunde)]

(In reply to Mark Capella [:capella] from comment #2)
> XULTreeAccessible::TreeViewInvalidated(), and
> XULTreeItemAccessibleBase::GroupPosition() look like last two methods
> without mTreeView checks after we added one for bug 757203 into
> XULTreeAccessible::InvalidateCache() ...
> 
> Possible fix? Os is this over-simplistic?

looks to me like exactly the same issue as bug 757203 so the right fix is to null check mTree and if its null clear the cache nd return.

I'm not sure why you mention a method on nsXULTreeItemAccessibleBase

note  I'm becoming more convinced the real right solution is to stop using DOM events to update the cache.

Comment 4

[Mark Capella [:capella]]

Attachment: Patch (v1)

Comment 5

[Mark Capella [:capella]]

push to try:
https://tbpl.mozilla.org/?tree=Try&rev=e43fa88b33da

Comment 6

[Mark Capella [:capella]]

https://tbpl.mozilla.org/?tree=Mozilla-Inbound&rev=7504d07db7ab

Comment 7

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/7504d07db7ab