103903 - M095 Trunk crash in nsHTMLImageAccessible.cpp [@ nsHTMLImageAccessible::nsHTMLImageAccessible]

Status: VERIFIED FIXED

(Core :: DOM: Core & HTML, defect, P1)

Description

[Robert Ginda]

When inspecting a window object in the js debugger, nsHTMLImageAccessible.cpp
causes a crash.

Index: nsHTMLImageAccessible.cpp
===================================================================
RCS file: /cvsroot/mozilla/accessible/src/nsHTMLImageAccessible.cpp,v
retrieving revision 1.11
diff -u -r1.11 nsHTMLImageAccessible.cpp
--- nsHTMLImageAccessible.cpp	2001/09/25 22:32:27	1.11
+++ nsHTMLImageAccessible.cpp	2001/10/09 19:37:27
@@ -58,7 +58,8 @@
   nsCOMPtr<nsIDOMElement> element(do_QueryInterface(aDOMNode));
   nsCOMPtr<nsIDocument> doc;
   nsCOMPtr<nsIPresShell> shell(do_QueryReferent(mPresShell));
-  NS_ASSERTION(shell,"Shell is gone!!! What are we doing here?");
+  if (NS_WARN_IF_FALSE(shell,"Shell is gone!!! What are we doing here?"))
+    return;
 
   shell->GetDocument(getter_AddRefs(doc));
   nsAutoString mapElementName;

Top of stack looked like this...
(gdb) where
#0  0x42571aa4 in nsHTMLImageAccessible::nsHTMLImageAccessible (
    this=0x8b9ab70, aDOMNode=0x8ba8e30, aShell=0x0)
    at nsHTMLImageAccessible.cpp:63
#1  0x425690bf in nsAccessibilityService::CreateXULImageAccessible (
    this=0x8db51f0, aNode=0x8ba8e30, _retval=0xbfff955c)
    at nsAccessibilityService.cpp:351
#2  0x401e9300 in XPTC_InvokeByIndex (that=0x8db51f0, methodIndex=15, 
    paramCount=2, params=0xbfff954c) at xptcinvoke_unixish_x86.cpp:153

Comment 1

[Robert Ginda]

On second thought, maybe we should check for the lack of a shell in
nsAccessibilityService::CreateXULImageAccessible instead of bailing on the
nsHTMLImageAccessible constructor.  Is a lack of a shell a failure?

Comment 2

[Aaron Leventhal]

Apparently the shell can go away any time, and we're holding a weak reference to it.

We should probably check and return if the shell is null everywhere we use
nsCOMPtr<nsIPresShell> shell = do_QueryReference(weakShell);

Comment 3

[Robert Ginda]

This crash is *very* easy to stumble across in the debugger.  Just hit a
breakpoint, and try to browse the window object.  Something many users are
likely do the the first time they run the debugger.  I'd appreciate if some fix
for this particular crash could go in ASAP, as opposed to 0.9.7.

Comment 4

[Aaron Leventhal]

Attachment: Cleans up shell checking after do_QueryReferent(weakShell) calls

Comment 5

[John Gaunt (redfive)]

Comment on attachment 53057 [details] [diff] [review]
Cleans up shell checking after do_QueryReferent(weakShell) calls

r=jgaunt

Comment 6

[Brendan Eich [:brendan]]

Comment on attachment 53057 [details] [diff] [review]
Cleans up shell checking after do_QueryReferent(weakShell) calls

sr=[e-mail]

Comment 7

[Aaron Leventhal]

fix checked in

Comment 8

[Robert Ginda]

thanks!

Comment 9

[greer]

This one shows up as a topcrasher in M095 and the Trunk, but all incidents are
prior to checkin. Marking varified and adding all that good talkback info to
summary, keywords and cc list.