1493403 - Crash in mozilla::a11y::AccGroupInfo::TotalItemCount

Status: VERIFIED FIXED

(Core :: Disability Access APIs, defect)

Description

[Calixte Denizet (:calixte)]

This bug was filed from the Socorro interface and is
report bp-01855509-ce12-4bea-9f80-322770180922.
=============================================================

Top 10 frames of crashing thread:

0 xul.dll mozilla::a11y::AccGroupInfo::TotalItemCount accessible/base/AccGroupInfo.cpp:236
1 xul.dll mozilla::a11y::Accessible::NativeAttributes accessible/generic/Accessible.cpp:1052
2 xul.dll mozilla::a11y::HyperTextAccessible::NativeAttributes accessible/generic/HyperTextAccessible.cpp:1095
3 xul.dll mozilla::a11y::Accessible::Attributes accessible/generic/Accessible.cpp:972
4 xul.dll mozilla::a11y::ia2Accessible::get_attributes accessible/windows/ia2/ia2Accessible.cpp:489
5 xul.dll void mozilla::a11y::HandlerProvider::BuildDynamicIA2Data accessible/ipc/win/HandlerProvider.cpp:315
6 xul.dll void mozilla::a11y::HandlerProvider::BuildInitialIA2Data accessible/ipc/win/HandlerProvider.cpp:389
7 xul.dll nsresult mozilla::detail::RunnableMethodImpl<mozilla::a11y::HandlerProvider*, void  xpcom/threads/nsThreadUtils.h:1229
8 xul.dll void `anonymous namespace'::SyncRunnable::APCRun ipc/mscom/MainThreadInvoker.cpp:64
9 xul.dll static void mozilla::mscom::MainThreadInvoker::MainThreadAPC ipc/mscom/MainThreadInvoker.cpp:187

=============================================================

There are 6 crashes (from 2 installations) in nightly 64 with buildid 20180922100157. In analyzing the backtrace, the regression may have been introduced by patch [1] to fix bug 1489324.

[1] https://hg.mozilla.org/mozilla-central/rev?node=df90cba28373

Comment 1

[James Teh [:Jamie]]

Attachment: Bug 1493403: AccGroupInfo::TotalItemCount: Don't assume a container has children.

The code does check for the case where a container has no children.
However, before it does so, it tries to check whether it needs to skip a text leaf child.
This check previously assumed there was a child to check, which crashed for a container with no children.

Comment 2

[Eitan Isaacson [:eeejay]]

Comment on attachment 9011327 [details]
Bug 1493403: AccGroupInfo::TotalItemCount: Don't assume a container has children.

Eitan Isaacson [:eeejay] has approved the revision.

Comment 3

[alexander :surkov (:asurkov)]

(In reply to James Teh [:Jamie] from comment #1)
> Created attachment 9011327 [details]
> Bug 1493403: AccGroupInfo::TotalItemCount: Don't assume a container has
> children.
> 
> The code does check for the case where a container has no children.
> However, before it does so, it tries to check whether it needs to skip a
> text leaf child.
> This check previously assumed there was a child to check, which crashed for
> a container with no children.

could you add a crash test pls? just to stay on a safe side

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/0648f196a589
AccGroupInfo::TotalItemCount: Don't assume a container has children. r=eeejay

Comment 5

[Ed Morley [:emorley]]

Could you ask the sheriffs to expedite the merge to mozilla-central, or else cherrypick there? It would be good to get this fixed in Nightly as soon as possible, since Nightly is pretty unusable for me due to this at the moment. Thanks :-)

Comment 6

[Cristina Coroiu [:ccoroiu]]

https://hg.mozilla.org/mozilla-central/rev/0648f196a589

Comment 7

[Calixte Denizet (:calixte)]

No more crashes since the patch landed.