crash at mozilla::a11y::Accessible::HasGenericType (nsAccessiblePivot caller)

RESOLVED FIXED in Firefox 61

Status

()

P2
normal
RESOLVED FIXED
a year ago
7 months ago

People

(Reporter: surkov, Assigned: eeejay)

Tracking

unspecified
mozilla61
Points:
---

Firefox Tracking Flags

(firefox61 fixed)

Details

Attachments

(1 attachment)

(Reporter)

Description

a year ago
here's a stack https://crash-stats.mozilla.com/report/index/a0119458-76b8-438d-8bc4-e9fd80170729

It seems nsAccessiblePivot::MovePreviousByText makes some incorrect assumptions about 'tempPosition' variable. Not super high volume, but there's a number of them on 54/55 [1]. Taking into account the user amount of accessFu is not high either, then it may be more visible problem than we may think looking at numbers.

Cc'ing Eitan and Yura.

[1] https://crash-stats.mozilla.com/signature/?signature=mozilla%3A%3Aa11y%3A%3AAccessible%3A%3AHasGenericType&date=%3E%3D2017-07-26T14%3A39%3A00.000Z&date=%3C2017-08-02T14%3A39%3A00.000Z&_columns=date&_columns=product&_columns=version&_columns=build_id&_columns=platform&_columns=reason&_columns=address&_columns=install_time&_sort=-version&_sort=-date&page=1
This is a P1 bug without an assignee. 

P1 are bugs which are being worked on for the current release cycle/iteration/sprint. 

If the bug is not assigned by Monday, 28 August, the bug's priority will be reset to '--'.
Keywords: stale-bug
(Reporter)

Updated

a year ago
Priority: P1 → P2
(Reporter)

Comment 2

a year ago
Eitan, since you are looking at accessFu stuff anyways, then would you mind to check this one out too?
Flags: needinfo?(eitan)
(Assignee)

Comment 3

7 months ago
Created attachment 8961567 [details] [diff] [review]
Check if tempPosition is null in pivot move by text. r?surkov
Attachment #8961567 - Flags: review?(surkov.alexander)
(Reporter)

Comment 4

7 months ago
Comment on attachment 8961567 [details] [diff] [review]
Check if tempPosition is null in pivot move by text. r?surkov

Review of attachment 8961567 [details] [diff] [review]:
-----------------------------------------------------------------

::: accessible/base/nsAccessiblePivot.cpp
@@ +316,5 @@
>    int32_t tempStart = mStartOffset, tempEnd = mEndOffset;
>    Accessible* tempPosition = mPosition;
>    Accessible* root = GetActiveRoot();
>    while (true) {
> +    NS_ENSURE_TRUE(tempPosition, NS_ERROR_UNEXPECTED);

right, I forgot we are in XPCOM world :) havnt' see those foe a while
Attachment #8961567 - Flags: review?(surkov.alexander) → review+
(Assignee)

Updated

7 months ago
Assignee: nobody → eitan
Flags: needinfo?(eitan)
Keywords: stale-bug → checkin-needed

Comment 5

7 months ago
Pushed by ryanvm@gmail.com:
https://hg.mozilla.org/integration/mozilla-inbound/rev/6c26d163c132
Check if tempPosition is null in pivot move by text. r=surkov
Keywords: checkin-needed

Comment 6

7 months ago
bugherder
https://hg.mozilla.org/mozilla-central/rev/6c26d163c132
Status: NEW → RESOLVED
Last Resolved: 7 months ago
status-firefox61: --- → fixed
Resolution: --- → FIXED
Target Milestone: --- → mozilla61
You need to log in before you can comment on or make changes to this bug.