Closed Bug 1574123 Opened 4 months ago Closed 4 months ago

Crash in [@ nsContainerFrame::GetSpokenMarkerText]

Categories

(Core :: Layout: Generated Content, Lists, and Counters, defect, P2, critical)

defect

Tracking

()

RESOLVED FIXED
mozilla70
Tracking Status
firefox-esr60 --- unaffected
firefox-esr68 --- unaffected
firefox68 --- unaffected
firefox69 --- unaffected
firefox70 --- fixed

People

(Reporter: MarcoZ, Assigned: mats)

References

(Regression)

Details

(Keywords: access, crash, testcase-wanted)

Crash Data

Attachments

(1 file, 1 obsolete file)

This bug is for crash report bp-ca403338-e0c7-48c0-b440-3a39d0190815.

Top 10 frames of crashing thread:

0 xul.dll nsContainerFrame::GetSpokenMarkerText layout/generic/nsContainerFrame.cpp:1742
1 xul.dll mozilla::a11y::ENameValueFlag mozilla::a11y::HTMLListBulletAccessible::Name accessible/html/HTMLListAccessible.cpp:131
2 xul.dll void mozilla::a11y::HTMLListBulletAccessible::AppendTextTo accessible/html/HTMLListAccessible.cpp:147
3 xul.dll mozilla::a11y::nsAccUtils::TextLength accessible/base/nsAccUtils.cpp:388
4 xul.dll mozilla::a11y::HyperTextAccessible::GetChildOffset accessible/generic/HyperTextAccessible.cpp:1906
5 xul.dll mozilla::a11y::NotificationController::QueueMutationEvent accessible/base/NotificationController.cpp:207
6 xul.dll mozilla::a11y::TreeMutation::AfterInsertion accessible/base/EventTree.cpp:69
7 xul.dll mozilla::a11y::DocAccessible::ProcessContentInserted accessible/generic/DocAccessible.cpp:1883
8 xul.dll void mozilla::a11y::NotificationController::WillRefresh accessible/base/NotificationController.cpp:741
9 xul.dll void nsRefreshDriver::Tick layout/base/nsRefreshDriver.cpp:1937

This is most likely fallout from landing of bug 1105868. Mats, is this a case of just checking the markerpseudo and marker variables to not be null?

See comment #0 last paragraph.

Flags: needinfo?(mats)
Assignee: nobody → mats
Component: CSS Parsing and Computation → Layout: Generated Content, Lists, and Counters
Flags: needinfo?(mats)
OS: Windows 10 → All
Priority: -- → P2
Hardware: Unspecified → All

Marco, if you can figure out to make a crashtest for this would be great.

(This basically addresses the review comments that I missed in
bug 1105868 part 4. My bad.)

Attachment #9085711 - Attachment is obsolete: true
Pushed by mpalmgren@mozilla.com:
https://hg.mozilla.org/integration/autoland/rev/5f30bde41790
Use nsLayoutUtils::GetMarkerFrame() more to avoid manual null-checks.  r=emilio
Flags: in-testsuite?
Keywords: testcase-wanted
Attachment #9085711 - Attachment is obsolete: false
Attachment #9085711 - Attachment is obsolete: true

(In reply to Mats Palmgren (:mats) from comment #3)

Marco, if you can figure out to make a crashtest for this would be great.

Asa encountered this, the above is his crash. Asa, what site were you on, and which AT did you have running, when you encountered this crash?

Flags: needinfo?(asa)

I can reliably crash at this URL https://www.flickr.com/photos/factoryjoe/9595219

Accessibility Instantiator UNKNOWN|

Flags: needinfo?(asa)
Status: NEW → RESOLVED
Closed: 4 months ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla70
You need to log in before you can comment on or make changes to this bug.