Closed Bug 1034640 Opened 10 years ago Closed 10 years ago

crash in nsAccessibilityService::CreateAccessibleByFrameType(nsIFrame*, nsIContent*, mozilla::a11y::Accessible*)

Categories

(Core :: Disability Access APIs, defect)

Product:
Core
Component:
Disability Access APIs
Platform:
All
macOS
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED FIXED
Milestone:
mozilla33

People

(Reporter: martijn.martijn, Assigned: surkov)

Details

(Keywords: crash, testcase)

Crash Data

Attachments

(2 files, 2 obsolete files)

testcase
824 bytes, text/html
Details
patch
1.10 KB, patch
tbsaunde
: review+
Details | Diff | Splinter Review
Attached file testcase (obsolete) — 
See testcase, which crashes within 50ms after load.
You need to have the specialpowers extension installed to get the crash: 
http://people.mozilla.org/~mwargers/extensions/specialpowers/specialpowers_20140612.xpi

The iframe content consists of this:
<html><head></head>
<body style="display: table-row;">
<table style="display: inline; visibility: collapse;">
<tbody>
<tr style="display: list-item;">
</tr>
</tbody>
</table>
</body>
</html>

This bug was filed from the Socorro interface and is 
report bp-9017e5bf-899a-4f39-8987-7eb3b2140704.
=============================================================
0 	XUL 	nsAccessibilityService::CreateAccessibleByFrameType(nsIFrame*, nsIContent*, mozilla::a11y::Accessible*) 	accessible/generic/Accessible-inl.h
1 	XUL 	nsAccessibilityService::GetOrCreateAccessible(nsINode*, mozilla::a11y::Accessible*, bool*) 	accessible/base/nsAccessibilityService.cpp
2 	XUL 	mozilla::a11y::TreeWalker::NextChildInternal(bool) 	accessible/base/TreeWalker.cpp
3 	XUL 	mozilla::a11y::DocAccessible::CacheChildren() 	accessible/base/TreeWalker.h
4 	XUL 	mozilla::a11y::DocAccessible::CacheChildrenInSubtree(mozilla::a11y::Accessible*, mozilla::a11y::Accessible**) 	accessible/generic/Accessible.cpp
5 	XUL 	mozilla::a11y::DocAccessible::ProcessContentInserted(mozilla::a11y::Accessible*, nsTArray<nsCOMPtr<nsIContent> > const*) 	accessible/generic/DocAccessible.cpp
6 	XUL 	mozilla::a11y::NotificationController::TextEnumerator(mozilla::a11y::NotificationController::nsCOMPtrHashKey<nsIContent>*, void*) 	accessible/base/NotificationController.cpp
7 	XUL 	PL_DHashTableEnumerate(PLDHashTable*, PLDHashOperator (*)(PLDHashTable*, PLDHashEntryHdr*, unsigned int, void*), void*) 	xpcom/glue/pldhash.cpp
8 	XUL 	mozilla::a11y::NotificationController::WillRefresh(mozilla::TimeStamp) 	obj-firefox/x86_64/dist/include/nsTHashtable.h
9 	XUL 	nsRefreshDriver::Tick(long long, mozilla::TimeStamp) 	layout/base/nsRefreshDriver.cpp
10 	XUL 	mozilla::RefreshDriverTimer::Tick() 	layout/base/nsRefreshDriver.cpp
The testcase doesn't seem to crash online.
I cannot reproduce it all. Stack is not clear enough.
Attached file testcase (obsolete) — 
The testcase seems to crash on reload.
This is on MacOS10.9.3, btw.
Attachment #8451038 - Attachment is obsolete: true
Attached file testcase — 
Sorry, this should crash online, after the SpecialPowers extension was installed (which makes accessibility turn on with the testcase).
The testcase now automatically reloads and should crash on reload after 1s.
Attachment #8452557 - Attachment is obsolete: true
Attached patch patch — — Splinter Review 
aContext is hanging document accessible (not bound to parent document yet) and thus it doesn't have a parent. I don't think we allow cross document tables so it doesn't make sense to wait for document binding before we update it.
Assignee: nobody → surkov.alexander
Status: NEW → ASSIGNED
Attachment #8453250 - Flags: review?(trev.saunders)
Comment on attachment 8453250 [details] [diff] [review]
patch

>       Accessible* table = aContext->IsTable() ?
>         aContext :
>-        (aContext->Parent()->IsTable() ? aContext->Parent() : nullptr);
>+        (aContext->Parent() && aContext->Parent()->IsTable() ?
>+         aContext->Parent() : nullptr);

this nested ? thing is kind of rediculous, use an if?
Attachment #8453250 - Flags: review?(trev.saunders) → review+
https://hg.mozilla.org/mozilla-central/rev/06a47123670e
Status: ASSIGNED → RESOLVED
Closed: 10 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla33
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: