1746827 - Crash in [@ PLDHashTable::Search | mozilla::a11y::RemoteAccessibleBase<T>::MinValue]

Status: RESOLVED FIXED

(Core :: Disability Access APIs, defect, P1)

Description

[James Teh [:Jamie]]

Crash report: https://crash-stats.mozilla.org/report/index/1bb09768-7ebe-43c5-acc4-1e67c0211216

Reason: EXCEPTION_ACCESS_VIOLATION_READ

Top 10 frames of crashing thread:

0 xul.dll PLDHashTable::Search const xpcom/ds/PLDHashTable.cpp:496
1 xul.dll mozilla::a11y::RemoteAccessibleBase<mozilla::a11y::RemoteAccessible>::MinValue const accessible/ipc/RemoteAccessibleBase.cpp:221
2 xul.dll mozilla::a11y::ia2AccessibleValue::get_minimumValue accessible/windows/ia2/ia2AccessibleValue.cpp:118
3 fsdomnodefirefoxmp.dll fsdomnodefirefoxmp.dll@0x0000000000032f3a 
4 ntdll.dll RtlpFreeHeapInternal 
5 ntdll.dll RtlFreeHeap 
6 None @0x000000e129ffb4f7 
7 fsdomnodefirefoxmp.dll fsdomnodefirefoxmp.dll@0x00000000000319b0 
8 fsdomnodefirefoxmp.dll fsdomnodefirefoxmp.dll@0x0000000000003e33 
9 fsdomnodefirefoxmp.dll fsdomnodefirefoxmp.dll@0x00000000000508cf 

I'm fairly sure this happens because RemoteAccessibleBase::Min/Cur/MaxValue doesn't null check mCachedFields. I wasn't able to come up with a test case that reproduces this, since it's actually pretty hard to end up with no cached fields now.

Comment 1

[James Teh [:Jamie]]

Attachment: Bug 1746827: Null check mCachedFields in RemoteAccessibleBase::Min/Cur/MaxValue/Step.

It's rare that mCachedFields is null now, but it seems it can still happen.

Comment 2

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/3a50c2e5557f
Null check mCachedFields in RemoteAccessibleBase::Min/Cur/MaxValue/Step. r=eeejay

Comment 3

[Marian-Vasile Laza]

https://hg.mozilla.org/mozilla-central/rev/3a50c2e5557f