crash in mozilla::a11y::DocAccessible::SeizeChild

RESOLVED FIXED in Firefox 45

Status

()

Core
Disability Access APIs
--
critical
RESOLVED FIXED
2 years ago
2 years ago

People

(Reporter: davidb, Assigned: surkov)

Tracking

({crash})

44 Branch
mozilla45
Unspecified
Windows NT
crash
Points:
---

Firefox Tracking Flags

(firefox45 fixed)

Details

(crash signature)

Attachments

(1 attachment)

This bug was filed from the Socorro interface and is 
report bp-e7cef379-2783-41c3-9762-b32a12151101.
=============================================================

More here: https://crash-stats.mozilla.com/report/list?product=Firefox&signature=mozilla%3A%3Aa11y%3A%3ADocAccessible%3A%3ASeizeChild
(Assignee)

Comment 1

2 years ago
Created attachment 8683771 [details] [diff] [review]
patch

no good ideas so far, so null checks + assertions, hope to see it in wild
Attachment #8683771 - Flags: review?(dbolter)
(Assignee)

Comment 2

2 years ago
Comment on attachment 8683771 [details] [diff] [review]
patch

Review of attachment 8683771 [details] [diff] [review]:
-----------------------------------------------------------------

::: accessible/generic/DocAccessible.cpp
@@ +2165,5 @@
>        Accessible* owner = child->Parent();
> +      if (!owner) {
> +        NS_ERROR("Cannot put the child back. No parent, a broken tree.");
> +        continue;
> +      }

for bug 1221543

::: accessible/windows/ia2/ia2Accessible.cpp
@@ +665,5 @@
>    Accessible* child = accWithCaret;
>    while (!child->IsDoc() && child != acc)
>      child = child->Parent();
>  
> +  if (child != acc)

artifiact from previous patch, removed
Assignee: nobody → surkov.alexander
Comment on attachment 8683771 [details] [diff] [review]
patch

Review of attachment 8683771 [details] [diff] [review]:
-----------------------------------------------------------------

::: accessible/generic/DocAccessible.cpp
@@ +2072,5 @@
>                            int32_t aIdxInParent)
>  {
>    Accessible* oldParent = aChild->Parent();
> +  if (!oldParent) {
> +    NS_ERROR("No parent? The tree is broken!");

On windows will this end up as a dialog box the user reads? If so, I don't know if we'll catch it in the wild...
(Assignee)

Comment 4

2 years ago
(In reply to David Bolter [:davidb] from comment #3)

> >    Accessible* oldParent = aChild->Parent();
> > +  if (!oldParent) {
> > +    NS_ERROR("No parent? The tree is broken!");
> 
> On windows will this end up as a dialog box the user reads? If so, I don't
> know if we'll catch it in the wild...

on debug only I think (which is controlled by a preference iirc), maybe we will be lucky and handle that one day in testing
Attachment #8683771 - Flags: review?(dbolter) → review+

Comment 5

2 years ago
https://hg.mozilla.org/integration/mozilla-inbound/rev/d07c33d0854c

Comment 6

2 years ago
bugherder
https://hg.mozilla.org/mozilla-central/rev/d07c33d0854c
Status: NEW → RESOLVED
Last Resolved: 2 years ago
status-firefox45: --- → fixed
Resolution: --- → FIXED
Target Milestone: --- → mozilla45
You need to log in before you can comment on or make changes to this bug.