Closed Bug 1034640 Opened 7 years ago Closed 7 years ago

crash in nsAccessibilityService::CreateAccessibleByFrameType(nsIFrame*, nsIContent*, mozilla::a11y::Accessible*)

Categories

(Core :: Disability Access APIs, defect)

All
macOS
defect
Not set
critical

Tracking

()

RESOLVED FIXED
mozilla33

People

(Reporter: martijn.martijn, Assigned: surkov)

Details

(Keywords: crash, testcase)

Crash Data

Attachments

(2 files, 2 obsolete files)

Attached file testcase (obsolete) —
See testcase, which crashes within 50ms after load.
You need to have the specialpowers extension installed to get the crash: 
http://people.mozilla.org/~mwargers/extensions/specialpowers/specialpowers_20140612.xpi

The iframe content consists of this:
<html><head></head>
<body style="display: table-row;">
<table style="display: inline; visibility: collapse;">
<tbody>
<tr style="display: list-item;">
</tr>
</tbody>
</table>
</body>
</html>

This bug was filed from the Socorro interface and is 
report bp-9017e5bf-899a-4f39-8987-7eb3b2140704.
=============================================================
0 	XUL 	nsAccessibilityService::CreateAccessibleByFrameType(nsIFrame*, nsIContent*, mozilla::a11y::Accessible*) 	accessible/generic/Accessible-inl.h
1 	XUL 	nsAccessibilityService::GetOrCreateAccessible(nsINode*, mozilla::a11y::Accessible*, bool*) 	accessible/base/nsAccessibilityService.cpp
2 	XUL 	mozilla::a11y::TreeWalker::NextChildInternal(bool) 	accessible/base/TreeWalker.cpp
3 	XUL 	mozilla::a11y::DocAccessible::CacheChildren() 	accessible/base/TreeWalker.h
4 	XUL 	mozilla::a11y::DocAccessible::CacheChildrenInSubtree(mozilla::a11y::Accessible*, mozilla::a11y::Accessible**) 	accessible/generic/Accessible.cpp
5 	XUL 	mozilla::a11y::DocAccessible::ProcessContentInserted(mozilla::a11y::Accessible*, nsTArray<nsCOMPtr<nsIContent> > const*) 	accessible/generic/DocAccessible.cpp
6 	XUL 	mozilla::a11y::NotificationController::TextEnumerator(mozilla::a11y::NotificationController::nsCOMPtrHashKey<nsIContent>*, void*) 	accessible/base/NotificationController.cpp
7 	XUL 	PL_DHashTableEnumerate(PLDHashTable*, PLDHashOperator (*)(PLDHashTable*, PLDHashEntryHdr*, unsigned int, void*), void*) 	xpcom/glue/pldhash.cpp
8 	XUL 	mozilla::a11y::NotificationController::WillRefresh(mozilla::TimeStamp) 	obj-firefox/x86_64/dist/include/nsTHashtable.h
9 	XUL 	nsRefreshDriver::Tick(long long, mozilla::TimeStamp) 	layout/base/nsRefreshDriver.cpp
10 	XUL 	mozilla::RefreshDriverTimer::Tick() 	layout/base/nsRefreshDriver.cpp
The testcase doesn't seem to crash online.
I cannot reproduce it all. Stack is not clear enough.
Attached file testcase (obsolete) —
The testcase seems to crash on reload.
This is on MacOS10.9.3, btw.
Attachment #8451038 - Attachment is obsolete: true
Attached file testcase
Sorry, this should crash online, after the SpecialPowers extension was installed (which makes accessibility turn on with the testcase).
The testcase now automatically reloads and should crash on reload after 1s.
Attachment #8452557 - Attachment is obsolete: true
Attached patch patchSplinter Review
aContext is hanging document accessible (not bound to parent document yet) and thus it doesn't have a parent. I don't think we allow cross document tables so it doesn't make sense to wait for document binding before we update it.
Assignee: nobody → surkov.alexander
Status: NEW → ASSIGNED
Attachment #8453250 - Flags: review?(trev.saunders)
Comment on attachment 8453250 [details] [diff] [review]
patch

>       Accessible* table = aContext->IsTable() ?
>         aContext :
>-        (aContext->Parent()->IsTable() ? aContext->Parent() : nullptr);
>+        (aContext->Parent() && aContext->Parent()->IsTable() ?
>+         aContext->Parent() : nullptr);

this nested ? thing is kind of rediculous, use an if?
Attachment #8453250 - Flags: review?(trev.saunders) → review+
https://hg.mozilla.org/mozilla-central/rev/06a47123670e
Status: ASSIGNED → RESOLVED
Closed: 7 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla33
You need to log in before you can comment on or make changes to this bug.