1387608 - crash at mozilla::a11y::Accessible::HasGenericType (nsAccessiblePivot caller)

Status: RESOLVED FIXED

(Core :: Disability Access APIs, enhancement, P2)

Description

[alexander :surkov (:asurkov)]

here's a stack https://crash-stats.mozilla.com/report/index/a0119458-76b8-438d-8bc4-e9fd80170729

It seems nsAccessiblePivot::MovePreviousByText makes some incorrect assumptions about 'tempPosition' variable. Not super high volume, but there's a number of them on 54/55 [1]. Taking into account the user amount of accessFu is not high either, then it may be more visible problem than we may think looking at numbers.

Cc'ing Eitan and Yura.

[1] https://crash-stats.mozilla.com/signature/?signature=mozilla%3A%3Aa11y%3A%3AAccessible%3A%3AHasGenericType&date=%3E%3D2017-07-26T14%3A39%3A00.000Z&date=%3C2017-08-02T14%3A39%3A00.000Z&_columns=date&_columns=product&_columns=version&_columns=build_id&_columns=platform&_columns=reason&_columns=address&_columns=install_time&_sort=-version&_sort=-date&page=1

Comment 1

[Emma Humphries ☕️🎸🧞‍♀️✨ (she/they) [:emceeaich] (Pacific Time) use needinfo]

This is a P1 bug without an assignee. 

P1 are bugs which are being worked on for the current release cycle/iteration/sprint. 

If the bug is not assigned by Monday, 28 August, the bug's priority will be reset to '--'.

Comment 2

[alexander :surkov (:asurkov)]

Eitan, since you are looking at accessFu stuff anyways, then would you mind to check this one out too?

Comment 3

[Eitan Isaacson [:eeejay]]

Attachment: Check if tempPosition is null in pivot move by text. r?surkov

Comment 4

[alexander :surkov (:asurkov)]

Comment on attachment 8961567 [details] [diff] [review]
Check if tempPosition is null in pivot move by text. r?surkov

Review of attachment 8961567 [details] [diff] [review]:
-----------------------------------------------------------------

::: accessible/base/nsAccessiblePivot.cpp
@@ +316,5 @@
>    int32_t tempStart = mStartOffset, tempEnd = mEndOffset;
>    Accessible* tempPosition = mPosition;
>    Accessible* root = GetActiveRoot();
>    while (true) {
> +    NS_ENSURE_TRUE(tempPosition, NS_ERROR_UNEXPECTED);

right, I forgot we are in XPCOM world :) havnt' see those foe a while

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/6c26d163c132
Check if tempPosition is null in pivot move by text. r=surkov

Comment 6

[Bogdan Tara[:bogdan_tara | bogdant]]

https://hg.mozilla.org/mozilla-central/rev/6c26d163c132