1494883 - Crash in mozilla::a11y::AccIterator::Next

Status: RESOLVED FIXED

(Core :: Disability Access APIs, defect)

Description

[Calixte Denizet (:calixte)]

This bug was filed from the Socorro interface and is
report bp-a173dd71-953e-4c30-ab79-2a9340180928.
=============================================================

Top 10 frames of crashing thread:

0 xul.dll mozilla::a11y::AccIterator::Next accessible/base/AccIterator.cpp:41
1 xul.dll mozilla::a11y::TableAccessible::CellInRowAt accessible/generic/TableAccessible.cpp:264
2 xul.dll mozilla::a11y::HTMLTableHeaderCellAccessible::NativeRole accessible/html/HTMLTableAccessible.cpp:332
3 xul.dll mozilla::a11y::Accessible::Role accessible/generic/Accessible-inl.h:26
4 xul.dll static void mozilla::a11y::DocAccessibleChildBase::SerializeTree accessible/ipc/DocAccessibleChildBase.cpp:60
5 xul.dll static void mozilla::a11y::DocAccessibleChildBase::SerializeTree accessible/ipc/DocAccessibleChildBase.cpp:79
6 xul.dll static void mozilla::a11y::DocAccessibleChildBase::SerializeTree accessible/ipc/DocAccessibleChildBase.cpp:79
7 xul.dll mozilla::a11y::DocAccessibleChildBase::InsertIntoIpcTree accessible/ipc/DocAccessibleChildBase.cpp:92
8 xul.dll mozilla::a11y::DocAccessible::DoInitialUpdate accessible/generic/DocAccessible.cpp:1539
9 xul.dll mozilla::a11y::DocAccessibleWrap::DoInitialUpdate accessible/windows/msaa/DocAccessibleWrap.cpp:146

=============================================================

There is 1 crash in nightly 64 with buildid 20180926220146. In analyzing the backtrace, the regression may have been introduced by patch [1] to fix bug 1486668.

[1] https://hg.mozilla.org/mozilla-central/rev?node=001c36e011c4

Comment 1

[Marco Zehe (:MarcoZ)]

I believe this crash was submitted by me, and I am dealing with it in bug 1494707, where jkratzer found the crash with a fuzzer.

Comment 2

[[:philipp]]

no longer crashing after build 20181004100222, so it indeed seems to be fixed by 1494707.