crash in nsAccessibilityService::CreateAccessibleByFrameType(nsIFrame*, nsIContent*, mozilla::a11y::Accessible*)

RESOLVED FIXED in mozilla33

Status

()

Core
Disability Access APIs
--
critical
RESOLVED FIXED
4 years ago
4 years ago

People

(Reporter: Martijn Wargers (zombie), Assigned: surkov)

Tracking

({crash, testcase})

unspecified
mozilla33
All
Mac OS X
crash, testcase
Points:
---

Firefox Tracking Flags

(Not tracked)

Details

(crash signature)

Attachments

(2 attachments, 2 obsolete attachments)

(Reporter)

Description

4 years ago
Created attachment 8451038 [details]
testcase

See testcase, which crashes within 50ms after load.
You need to have the specialpowers extension installed to get the crash: 
http://people.mozilla.org/~mwargers/extensions/specialpowers/specialpowers_20140612.xpi

The iframe content consists of this:
<html><head></head>
<body style="display: table-row;">
<table style="display: inline; visibility: collapse;">
<tbody>
<tr style="display: list-item;">
</tr>
</tbody>
</table>
</body>
</html>

This bug was filed from the Socorro interface and is 
report bp-9017e5bf-899a-4f39-8987-7eb3b2140704.
=============================================================
0 	XUL 	nsAccessibilityService::CreateAccessibleByFrameType(nsIFrame*, nsIContent*, mozilla::a11y::Accessible*) 	accessible/generic/Accessible-inl.h
1 	XUL 	nsAccessibilityService::GetOrCreateAccessible(nsINode*, mozilla::a11y::Accessible*, bool*) 	accessible/base/nsAccessibilityService.cpp
2 	XUL 	mozilla::a11y::TreeWalker::NextChildInternal(bool) 	accessible/base/TreeWalker.cpp
3 	XUL 	mozilla::a11y::DocAccessible::CacheChildren() 	accessible/base/TreeWalker.h
4 	XUL 	mozilla::a11y::DocAccessible::CacheChildrenInSubtree(mozilla::a11y::Accessible*, mozilla::a11y::Accessible**) 	accessible/generic/Accessible.cpp
5 	XUL 	mozilla::a11y::DocAccessible::ProcessContentInserted(mozilla::a11y::Accessible*, nsTArray<nsCOMPtr<nsIContent> > const*) 	accessible/generic/DocAccessible.cpp
6 	XUL 	mozilla::a11y::NotificationController::TextEnumerator(mozilla::a11y::NotificationController::nsCOMPtrHashKey<nsIContent>*, void*) 	accessible/base/NotificationController.cpp
7 	XUL 	PL_DHashTableEnumerate(PLDHashTable*, PLDHashOperator (*)(PLDHashTable*, PLDHashEntryHdr*, unsigned int, void*), void*) 	xpcom/glue/pldhash.cpp
8 	XUL 	mozilla::a11y::NotificationController::WillRefresh(mozilla::TimeStamp) 	obj-firefox/x86_64/dist/include/nsTHashtable.h
9 	XUL 	nsRefreshDriver::Tick(long long, mozilla::TimeStamp) 	layout/base/nsRefreshDriver.cpp
10 	XUL 	mozilla::RefreshDriverTimer::Tick() 	layout/base/nsRefreshDriver.cpp
(Reporter)

Comment 1

4 years ago
The testcase doesn't seem to crash online.
(Assignee)

Comment 2

4 years ago
I cannot reproduce it all. Stack is not clear enough.
(Reporter)

Comment 3

4 years ago
Created attachment 8452557 [details]
testcase

The testcase seems to crash on reload.
This is on MacOS10.9.3, btw.
Attachment #8451038 - Attachment is obsolete: true
(Reporter)

Comment 4

4 years ago
Created attachment 8452560 [details]
testcase

Sorry, this should crash online, after the SpecialPowers extension was installed (which makes accessibility turn on with the testcase).
The testcase now automatically reloads and should crash on reload after 1s.
Attachment #8452557 - Attachment is obsolete: true
(Assignee)

Comment 5

4 years ago
Created attachment 8453250 [details] [diff] [review]
patch

aContext is hanging document accessible (not bound to parent document yet) and thus it doesn't have a parent. I don't think we allow cross document tables so it doesn't make sense to wait for document binding before we update it.
Assignee: nobody → surkov.alexander
Status: NEW → ASSIGNED
Attachment #8453250 - Flags: review?(trev.saunders)
Comment on attachment 8453250 [details] [diff] [review]
patch

>       Accessible* table = aContext->IsTable() ?
>         aContext :
>-        (aContext->Parent()->IsTable() ? aContext->Parent() : nullptr);
>+        (aContext->Parent() && aContext->Parent()->IsTable() ?
>+         aContext->Parent() : nullptr);

this nested ? thing is kind of rediculous, use an if?
Attachment #8453250 - Flags: review?(trev.saunders) → review+
https://hg.mozilla.org/mozilla-central/rev/06a47123670e
Status: ASSIGNED → RESOLVED
Last Resolved: 4 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla33
You need to log in before you can comment on or make changes to this bug.