Closed Bug 1222127 Opened 9 years ago Closed 9 years ago

crash in @ nsGlobalWindow::GetComputedStyleHelper

Categories

(Core :: DOM: Core & HTML, defect)

Product:
Core
Component:
DOM: Core & HTML
Type:
defect
Priority:
Not set
Severity:
normal

Tracking

()

Status:
RESOLVED FIXED
Milestone:
mozilla45
Tracking Flags:
Tracking Status
firefox44 + fixed
firefox45 --- fixed

People

(Reporter: surkov, Assigned: khuey)

References

(Blocks 1 open bug)

Details

(Keywords: access, regression)

Attachments

(1 file)

0001-Bug-1222127-Use-the-inner-window-to-compute-style.-r.patch
1.07 KB, patch
baku
: review+
ritu
: approval-mozilla-aurora+
Details | Diff | Splinter Review 
This one beats JAWS users (http://www.freedomscientific.com/Products/Blindness/JAWS), it crashes whenever Nightly is running (the issue has been reported by FS contact).

The stack is:

ntdll.dll!_KiFastSystemCallRet@0 ()     Unknown
        ntdll.dll!_ZwWaitForSingleObject@12 ()  Unknown
        ntdll.dll!_RtlReportExceptionEx@16 ()   Unknown
        ntdll.dll!_RtlReportException@12 ()     Unknown
        ole32.dll!SilentlyReportExceptions(_EXCEPTION_POINTERS * lpep) Line 133 C++
        ole32.dll!ServerExceptionFilter(_EXCEPTION_POINTERS * lpep) Line 190    C++
        ole32.dll!AppInvokeExceptionFilterWithMethodAddress(_EXCEPTION_POINTERS * lpep, void * pvObject, const _GUID & riid, unsigned long dwMethod, void * pvVtableAddress, const char * szPossibleCause) Line 379     C++
        ole32.dll!SyncStubInvoke(tagRPCOLEMESSAGE * pMsg, const _GUID & riid, CIDObject * pID, void * pVtableAddress, IRpcChannelBuffer * pChnl, IRpcStubBuffer * pStub, unsigned long * pdwFault) Line 1193    C++
        msvcrt.dll!@_EH4_CallFilterFunc@8 ()    Unknown
        ntdll.dll!ExecuteHandler2@20 () Unknown
        ntdll.dll!ExecuteHandler@20 ()  Unknown
        ntdll.dll!_RtlDispatchException@8 ()    Unknown
        ntdll.dll!_KiUserExceptionDispatcher@8 ()       Unknown
>       xul.dll!nsGlobalWindow::GetComputedStyleHelper(mozilla::dom::Element & aElt, const nsAString_internal & aPseudoElt, bool aDefaultStylesOnly, mozilla::ErrorResult & aError) Line 9997   C++
        xul.dll!nsGlobalWindow::GetComputedStyle(mozilla::dom::Element & aElt, const nsAString_internal & aPseudoElt, mozilla::ErrorResult & aError) Line 9910  C++
        xul.dll!mozilla::a11y::nsWinUtils::GetComputedStyleDeclaration(nsIContent * aContent) Line 56   C++
        xul.dll!mozilla::a11y::sdnAccessible::get_computedStyleForProperties(unsigned short aNumStyleProperties, unsigned char aUseAlternateView, wchar_t * * aStyleProperties, wchar_t * * aStyleValues) Line 282      C++
        FsDomNodeFirefox.dll!51682b54() Unknown

It crashes in:
nsGlobalWindow::GetComputedStyleHelper(Element& aElt,
                                       const nsAString& aPseudoElt,
                                       bool aDefaultStylesOnly,
                                       ErrorResult& aError)
 

On the line:
  FORWARD_TO_OUTER_OR_THROW(GetComputedStyleHelperOuter,
                            (aElt, aPseudoElt, aDefaultStylesOnly),
                            aError, nullptr);

Locals:
+                              this        msvcr120.dll!0x0028e040 {mRefCnt={mRefCntAndFlags=0 } mIdleObservers={...} mIdleTimer={...} ...}          nsGlobalWindow *
+                              aElt        {...}         mozilla::dom::Element &
+                              aPseudoElt         {mData=0x032033e0 L"" mLength=0 mFlags=1 }  const nsAString_internal &
                                aDefaultStylesOnly        false      bool
-                              aError    {mResult=NS_OK (0) mMessage=0x00000128 {mArgs={...} mErrorNumber=??? } mJSException={data={asBits=35747648459768104 ...} } ...}             mozilla::ErrorResult &
                                mResult               NS_OK (0)           nsresult
+                              mMessage          0x00000128 {mArgs={...} mErrorNumber=??? }   mozilla::ErrorResult::Message *
+                              mJSException    {data={asBits=35747648459768104 s={payload={i32=296 u32=296 boo=296 ...} tag=8323148 } asDouble=2.7591947984242959e-306 ...} }             JS::Value
+                              mDOMExceptionInfo     0x00000128 {mMessage={...} mRv=??? }                mozilla::ErrorResult::DOMExceptionInfo *
[Tracking Requested - why for this release]:

So nsGlobalWindow::GetComputedStyle should be called on an inner window.  nsWinUtils::GetComputedStyleDeclaration is calling it on the return value of nsIDocument::GetWindow, which is the outer window.  Kyle, did we just both miss this?
Blocks: 1216401
tracking-firefox44: --- → ?
Flags: needinfo?(khuey)
Keywords: regression
Yeah, that's just busted.  I'll fix it.
Assignee: nobody → khuey
Flags: needinfo?(khuey)
Attachment #8684572 - Flags: review?(wchen) → review+
https://hg.mozilla.org/mozilla-central/rev/692fd43da7cb
Status: NEW → RESOLVED
Closed: 9 years ago
status-firefox45: --- → fixed
Resolution: --- → FIXED
Target Milestone: --- → mozilla45
Is there any change to back port it to Aurora please?
Comment on attachment 8684572 [details] [diff] [review]
0001-Bug-1222127-Use-the-inner-window-to-compute-style.-r.patch

Approval Request Comment
[Feature/regressing bug #]: Bug 1222127
[User impact if declined]: a11y tools crash
[Describe test coverage new/current, TreeHerder]: manual testing
[Risks and why]: extremely low risk, patch is trivial
[String/UUID change made/needed]: N/A
Attachment #8684572 - Flags: approval-mozilla-aurora?
(In reply to Kyle Huey [:khuey] (khuey@mozilla.com) from comment #7)
> Comment on attachment 8684572 [details] [diff] [review]
> 0001-Bug-1222127-Use-the-inner-window-to-compute-style.-r.patch
> 
> Approval Request Comment
> [Feature/regressing bug #]: Bug 1222127

Er, bug 1216401.
Comment on attachment 8684572 [details] [diff] [review]
0001-Bug-1222127-Use-the-inner-window-to-compute-style.-r.patch

Crash fix, taking it for Aurora44.
Attachment #8684572 - Flags: approval-mozilla-aurora? → approval-mozilla-aurora+
Alexandar, could you please verify that this issue is fixed as expected on a latest Nightly build? Thanks!
Flags: needinfo?(surkov.alexander)
(In reply to Ritu Kothari (:ritu) from comment #11)
> Alexandar, could you please verify that this issue is fixed as expected on a
> latest Nightly build? Thanks!

I was reported that it's indeed fixed.
Flags: needinfo?(surkov.alexander)
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: