Closed Bug 1171728 Opened 7 years ago Closed 7 years ago

Crash @ mozilla::a11y::AccessibleWrap::GetAtkObject(mozilla::a11y::Accessible*) after bug 1169376

Categories

(Core :: Disability Access APIs, defect)

defect
Not set
normal

Tracking

()

RESOLVED FIXED
mozilla41
Tracking Status
firefox41 --- fixed

People

(Reporter: glandium, Assigned: tbsaunde)

References

Details

Attachments

(2 files)

https://treeherder.mozilla.org/logviewer.html#?job_id=12650&repo=elm

15:49:33 ERROR - PROCESS-CRASH | test_accessibility.py TestAccessibility.test_click_raises_no_exceptions | application crashed [@ mozilla::a11y::AccessibleWrap::GetAtkObject(mozilla::a11y::Accessible*)]
15:49:33 INFO - Crash dump filename: /tmp/tmp_Of4wI.mozrunner/minidumps/2eb47d6d-df27-d4f7-7832bcf9-492f3ad4.dmp
15:49:33 INFO - Operating system: Linux
15:49:33 INFO - 0.0.0 Linux 3.2.0-76-generic-pae #111-Ubuntu SMP Tue Jan 13 22:34:29 UTC 2015 i686
15:49:33 INFO - CPU: x86
15:49:33 INFO - GenuineIntel family 6 model 62 stepping 4
15:49:33 INFO - 1 CPU
15:49:33 INFO - Crash reason: SIGSEGV
15:49:33 INFO - Crash address: 0x0
15:49:33 INFO - Thread 0 (crashed)
15:49:33 INFO - 0 libxul.so!mozilla::a11y::AccessibleWrap::GetAtkObject(mozilla::a11y::Accessible*) [AccessibleWrap.cpp:ffe00ddad52b : 322 + 0x0]
15:49:33 INFO - eip = 0xb3ab241f esp = 0xbf97b128 ebp = 0xbf97b148 ebx = 0xb6121598
15:49:33 INFO - esi = 0x93bff910 edi = 0xa19d91c0 eax = 0x00000000 ecx = 0xbf97b13c
15:49:33 INFO - edx = 0x9aec8420 efl = 0x00210282
15:49:33 INFO - Found by: given as instruction pointer in context
15:49:33 INFO - 1 libxul.so!getParentCB [AccessibleWrap.cpp:ffe00ddad52b : 807 + 0xf]
15:49:33 INFO - eip = 0xb3ab3a61 esp = 0xbf97b150 ebp = 0xbf97b168 ebx = 0xb6121598
15:49:33 INFO - esi = 0x93bff910 edi = 0xa19d91c0
15:49:33 INFO - Found by: call frame info
15:49:33 INFO - 2 libatk-1.0.so.0.20409.1 + 0xaa15
15:49:33 INFO - eip = 0xb6920a16 esp = 0xbf97b170 ebp = 0xb72bb300 ebx = 0xb6934ff4
15:49:33 INFO - esi = 0x93bff910 edi = 0xa19d91c0
15:49:33 INFO - Found by: call frame info
15:49:33 INFO - 3 libgobject-2.0.so.0.3200.1 + 0x4dff3
15:49:33 INFO - eip = 0xb661fff4 esp = 0xbf97b17c ebp = 0xb72bb300
15:49:33 INFO - Found by: stack scanning
15:49:33 INFO - 4 libgtk-3.so.0.400.1 + 0x4b6ff3
15:49:33 INFO - eip = 0xb6fbeff4 esp = 0xbf97b180 ebp = 0xb72bb300
15:49:33 INFO - Found by: stack scanning
15:49:33 INFO - 5 libgtk-3.so.0.400.1 + 0x4b6ff3
15:49:33 INFO - eip = 0xb6fbeff4 esp = 0xbf97b184 ebp = 0xb72bb300
15:49:33 INFO - Found by: stack scanning 
(...)
Attachment #8616001 - Flags: review?(lorien)
Attachment #8616001 - Flags: review?(lorien) → review+
https://hg.mozilla.org/mozilla-central/rev/bd0374f08fcd
Status: NEW → RESOLVED
Closed: 7 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla41
Still crashing: https://treeherder.mozilla.org/logviewer.html#?job_id=13701&repo=elm


15:55:46 ERROR - PROCESS-CRASH | test_accessibility.py TestAccessibility.test_click_raises_no_exceptions | application crashed [@ mozilla::a11y::AccessibleWrap::GetAtkObject(mozilla::a11y::Accessible*)]
15:55:46 INFO - Crash dump filename: /tmp/tmpepN2XH.mozrunner/minidumps/0f6ace91-46c5-0af3-573caeee-388948ef.dmp
15:55:46 INFO - Operating system: Linux
15:55:46 INFO - 0.0.0 Linux 3.2.0-76-generic-pae #111-Ubuntu SMP Tue Jan 13 22:34:29 UTC 2015 i686
15:55:46 INFO - CPU: x86
15:55:46 INFO - GenuineIntel family 6 model 62 stepping 4
15:55:46 INFO - 1 CPU
15:55:46 INFO - Crash reason: SIGSEGV
15:55:46 INFO - Crash address: 0x0
15:55:46 INFO - Thread 0 (crashed)
15:55:46 INFO - 0 libxul.so!mozilla::a11y::AccessibleWrap::GetAtkObject(mozilla::a11y::Accessible*) [AccessibleWrap.cpp:19ad77ed0a03 : 322 + 0x0]
15:55:46 INFO - eip = 0xb3b2e2cf esp = 0xbfce4518 ebp = 0xbfce4538 ebx = 0xb61ac108
15:55:46 INFO - esi = 0x92cfe100 edi = 0x947e6190 eax = 0x00000000 ecx = 0xbfce452c
15:55:46 INFO - edx = 0x9c5fffb0 efl = 0x00210282
15:55:46 INFO - Found by: given as instruction pointer in context
15:55:46 INFO - 1 libxul.so!getParentCB [AccessibleWrap.cpp:19ad77ed0a03 : 807 + 0xf]
15:55:46 INFO - eip = 0xb3b2f91f esp = 0xbfce4540 ebp = 0xbfce4558 ebx = 0xb61ac108
15:55:46 INFO - esi = 0x92cfe100 edi = 0x947e6190
15:55:46 INFO - Found by: call frame info
15:55:46 INFO - 2 libatk-1.0.so.0.20409.1 + 0xaa15
15:55:46 INFO - eip = 0xb69a6a16 esp = 0xbfce4560 ebp = 0xb72bb300 ebx = 0xb69baff4
15:55:46 INFO - esi = 0x92cfe100 edi = 0x947e6190
15:55:46 INFO - Found by: call frame info
15:55:46 INFO - 3 libgobject-2.0.so.0.3200.1 + 0x4dff3
15:55:46 INFO - eip = 0xb66a5ff4 esp = 0xbfce456c ebp = 0xb72bb300
15:55:46 INFO - Found by: stack scanning
15:55:46 INFO - 4 libgtk-3.so.0.400.1 + 0x4b6ff3
15:55:46 INFO - eip = 0xb703eff4 esp = 0xbfce4570 ebp = 0xb72bb300
15:55:46 INFO - Found by: stack scanning
15:55:46 INFO - 5 libgtk-3.so.0.400.1 + 0x4b6ff3
15:55:46 INFO - eip = 0xb703eff4 esp = 0xbfce4574 ebp = 0xb72bb300 

That means proxy->OuterDocOfRemoteBrowser() is returning null.
Status: RESOLVED → REOPENED
Resolution: FIXED → ---
(In reply to Mike Hommey [:glandium] from comment #4)

> That means proxy->OuterDocOfRemoteBrowser() is returning null.

Thanks Mike. Trevor did you catch this?
(In reply to David Bolter [:davidb] from comment #5)
> (In reply to Mike Hommey [:glandium] from comment #4)
> 
> > That means proxy->OuterDocOfRemoteBrowser() is returning null.

yes, the interesting question is why.  layout tells accessibility to remove the outerDoc accessible for the <xul:browser> in question, but then doesn't recreate it, and the remote PBrowser that's related doesn't get shut down either.

> Thanks Mike. Trevor did you catch this?

yes, I've been debugging it
This probably isn't the right fix, or at least the root cause of
ProxyAccessible::OuterDocOfRemoteBrowser returning null needs to be understood
better, but I don't have time to do that now, so I'm just checking for null and
asserting as a reminder to investigate this later.
Attachment #8621089 - Flags: review?(dbolter)
Comment on attachment 8621089 [details] [diff] [review]
null check the result of ProxyAccessible::OuterDocOfRemoteBrowser

Review of attachment 8621089 [details] [diff] [review]:
-----------------------------------------------------------------

OK. A reasonable plan given the circumstances.

::: accessible/atk/AccessibleWrap.cpp
@@ +807,5 @@
>        // Otherwise this should be the proxy for the tab's top level document.
> +      Accessible* outerDocParent = proxy->OuterDocOfRemoteBrowser();
> +      NS_ASSERTION(outerDocParent, "this document should have an outerDoc as a parent");
> +      if (outerDocParent)
> +        atkParent = AccessibleWrap::GetAtkObject(outerDocParent);

nit: I'm in the always brace camp, and especially when the trailing close brace immediately follows. I'd settle for a spacer line after the single if block.
Attachment #8621089 - Flags: review?(dbolter) → review+
(In reply to David Bolter [:davidb] from comment #8)
> nit: I'm in the always brace camp, and especially when the trailing close
> brace immediately follows. I'd settle for a spacer line after the single if
> block.

Note there's only one camp: the code style guidelines camp. And the guidelines say always brace.
https://hg.mozilla.org/mozilla-central/rev/8c007327ed50
Status: REOPENED → RESOLVED
Closed: 7 years ago7 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.