Closed Bug 204934 Opened 21 years ago Closed 21 years ago

Trunk M140B topcrash [@ nsAccessibilityService::GetAccessible]

Categories

(Core :: Disability Access APIs, defect)

Product:
Core
Component:
Disability Access APIs
Platform:
x86
Windows 98
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED FIXED

People

(Reporter: jcarpenter0524, Assigned: aaronlev)

References

Details

(Keywords: crash, topcrash+)

Crash Data

Attachments

(1 file)

Add null checks. Also, avoid creating new child accessibles while getting children to set their mParent=nsnull;
2.36 KB, patch
yuanyi21
: review+
alecf
: superreview+
asa
: approval1.4+
Details | Diff | Splinter Review 
Rank    StackSignature    Count  

13   nsAccessibilityService::GetAccessible   15 

Source File :
c:/builds/seamonkey/mozilla/accessible/src/base/nsAccessibilityService.cpp line
: 1625
 
====================================================================================================
     Count   Offset    Real Signature
[ 7   nsAccessibilityService::GetAccessible feae175e -
nsAccessibilityService::GetAccessible ]
 
     Crash date range: 2003-05-05 to 2003-05-06
 
     Count   Platform List 
     4   Windows 98 4.10 build 67766446
     3   Windows NT 5.0 build 2195
 
     Count   Build Id List 
     7   2003050211
 
     No of Unique Users         3
 
 Stack trace(Frame) 

	 nsAccessibilityService::GetAccessible
[c:/builds/seamonkey/mozilla/accessible/src/base/nsAccessibilityService.cpp 
line 1625] 
	 nsAccessibilityService::GetAccessibleInWeakShell
[c:/builds/seamonkey/mozilla/accessible/src/base/nsAccessibilityService.cpp 
line 1508] 
	 nsAccessibleTreeWalker::GetAccessible
[c:/builds/seamonkey/mozilla/accessible/src/base/nsAccessibleTreeWalker.cpp 
line 338] 
	 nsCOMPtr_base::assign_with_AddRef
[c:/builds/seamonkey/mozilla/xpcom/glue/nsCOMPtr.cpp  line 71] 
	 nsAccessibleTreeWalker::GetNextSibling
[c:/builds/seamonkey/mozilla/accessible/src/base/nsAccessibleTreeWalker.cpp 
line 221] 
	 nsAccessible::GetAccNextSibling
[c:/builds/seamonkey/mozilla/accessible/src/base/nsAccessible.cpp  line 280] 
	 nsAccessible::Shutdown
[c:/builds/seamonkey/mozilla/accessible/src/base/nsAccessible.cpp  line 220] 
	 nsHTMLComboboxAccessible::Shutdown
[c:/builds/seamonkey/mozilla/accessible/src/html/nsHTMLSelectAccessible.cpp 
line 829] 
	 nsAccessNode::ClearCacheEntry
[c:/builds/seamonkey/mozilla/accessible/src/base/nsAccessNode.cpp  line 313] 
	 hashEnumerate	[c:/builds/seamonkey/mozilla/xpcom/ds/nsHashtable.cpp  line 121] 
	 PL_DHashTableEnumerate	[c:/builds/seamonkey/mozilla/xpcom/ds/pldhash.c  line 595] 
	 nsHashtable::Enumerate	[c:/builds/seamonkey/mozilla/xpcom/ds/nsHashtable.cpp 
line 304] 
	 nsAccessNode::ClearCache
[c:/builds/seamonkey/mozilla/accessible/src/base/nsAccessNode.cpp  line 319] 
	 nsDocAccessible::Shutdown
[c:/builds/seamonkey/mozilla/accessible/src/base/nsDocAccessible.cpp  line 292] 
	 nsDocAccessible::Destroy
[c:/builds/seamonkey/mozilla/accessible/src/base/nsDocAccessible.cpp  line 263] 
	 0x088b0674   
 
 
====================================================================================================
     Count   Offset    Real Signature
[ 4   nsAccessibilityService::GetAccessible 6accff53 -
nsAccessibilityService::GetAccessible ]
 
     Crash date range: 2003-05-04 to 2003-05-06
 
     Count   Platform List 
     4   Windows NT 5.1 build 2600
 
     Count   Build Id List 
     4   2003050108
 
     No of Unique Users         2
 
 Stack trace(Frame) 

	 nsAccessibilityService::GetAccessible
[c:/builds/seamonkey/mozilla/accessible/src/base/nsAccessibilityService.cpp 
line 1625] 
	 nsAccessibilityService::GetAccessibleInWeakShell
[c:/builds/seamonkey/mozilla/accessible/src/base/nsAccessibilityService.cpp 
line 1508] 
	 nsAccessibleTreeWalker::GetAccessible
[c:/builds/seamonkey/mozilla/accessible/src/base/nsAccessibleTreeWalker.cpp 
line 338] 
	 nsCOMPtr_base::assign_with_AddRef
[c:/builds/seamonkey/mozilla/xpcom/glue/nsCOMPtr.cpp  line 71] 
	 nsAccessibleTreeWalker::GetNextSibling
[c:/builds/seamonkey/mozilla/accessible/src/base/nsAccessibleTreeWalker.cpp 
line 232] 
	 nsAccessible::GetAccNextSibling
[c:/builds/seamonkey/mozilla/accessible/src/base/nsAccessible.cpp  line 280] 
	 nsAccessible::Shutdown
[c:/builds/seamonkey/mozilla/accessible/src/base/nsAccessible.cpp  line 220] 
	 nsHTMLComboboxAccessible::Shutdown
[c:/builds/seamonkey/mozilla/accessible/src/html/nsHTMLSelectAccessible.cpp 
line 829] 
	 nsAccessNode::ClearCacheEntry
[c:/builds/seamonkey/mozilla/accessible/src/base/nsAccessNode.cpp  line 313] 
	 hashEnumerate	[c:/builds/seamonkey/mozilla/xpcom/ds/nsHashtable.cpp  line 121] 
	 PL_DHashTableEnumerate	[c:/builds/seamonkey/mozilla/xpcom/ds/pldhash.c  line 595] 
	 nsHashtable::Enumerate	[c:/builds/seamonkey/mozilla/xpcom/ds/nsHashtable.cpp 
line 304] 
	 nsAccessNode::ClearCache
[c:/builds/seamonkey/mozilla/accessible/src/base/nsAccessNode.cpp  line 319] 
	 nsDocAccessible::Shutdown
[c:/builds/seamonkey/mozilla/accessible/src/base/nsDocAccessible.cpp  line 292] 
	 nsDocAccessible::Destroy
[c:/builds/seamonkey/mozilla/accessible/src/base/nsDocAccessible.cpp  line 263] 
	 nsWindow::~nsWindow
[c:/builds/seamonkey/mozilla/widget/src/windows/nsWindow.cpp  line 824] 
	 nsWindow::`scalar deleting destructor'  
	 nsWindow::Release	[c:/builds/seamonkey/mozilla/widget/src/windows/nsWindow.cpp
 line 699] 
	 nsCOMPtr_base::~nsCOMPtr_base
[c:/builds/seamonkey/mozilla/xpcom/glue/nsCOMPtr.cpp  line 66] 
	 DocumentViewerImpl::~DocumentViewerImpl
[c:/builds/seamonkey/mozilla/content/base/src/nsDocumentViewer.cpp  line 564] 
	 nsCOMPtr_base::~nsCOMPtr_base
[c:/builds/seamonkey/mozilla/xpcom/glue/nsCOMPtr.cpp  line 66] 
	 nsCOMPtr_base::assign_from_helper
[c:/builds/seamonkey/mozilla/xpcom/glue/nsCOMPtr.cpp  line 79] 
	 nsQueryInterface::operator()
[c:/builds/seamonkey/mozilla/xpcom/glue/nsCOMPtr.cpp  line 52] 
	 nsCOMPtr_base::assign_from_helper
[c:/builds/seamonkey/mozilla/xpcom/glue/nsCOMPtr.cpp  line 82] 
	 0xec8b5500   
 
     (19831345)	URL: www.dell.com
     (19810698)	URL: www.dell.com
     (19781158)	URL: www.godgames.com
     (19781158)	Comments: checking mail support page for patches...
 
====================================================================================================
     Count   Offset    Real Signature
[ 2   nsAccessibilityService::GetAccessible e4d261d0 -
nsAccessibilityService::GetAccessible ]
 
     Crash date range: 2003-05-06 to 2003-05-06
 
     Count   Platform List 
     2   Windows NT 5.1 build 2600
 
     Count   Build Id List 
     2   2003050509
 
     No of Unique Users         1
 
 Stack trace(Frame) 

	 nsAccessibilityService::GetAccessible
[c:/builds/seamonkey/mozilla/accessible/src/base/nsAccessibilityService.cpp 
line 1625] 
	 nsAccessibilityService::GetAccessibleInWeakShell
[c:/builds/seamonkey/mozilla/accessible/src/base/nsAccessibilityService.cpp 
line 1508] 
	 nsAccessibleTreeWalker::GetAccessible
[c:/builds/seamonkey/mozilla/accessible/src/base/nsAccessibleTreeWalker.cpp 
line 338] 
	 nsCOMPtr_base::assign_with_AddRef
[c:/builds/seamonkey/mozilla/xpcom/glue/nsCOMPtr.cpp  line 71] 
	 nsAccessibleTreeWalker::GetNextSibling
[c:/builds/seamonkey/mozilla/accessible/src/base/nsAccessibleTreeWalker.cpp 
line 232] 
	 nsAccessible::GetAccNextSibling
[c:/builds/seamonkey/mozilla/accessible/src/base/nsAccessible.cpp  line 280] 
	 nsAccessible::Shutdown
[c:/builds/seamonkey/mozilla/accessible/src/base/nsAccessible.cpp  line 220] 
	 nsHTMLComboboxAccessible::Shutdown
[c:/builds/seamonkey/mozilla/accessible/src/html/nsHTMLSelectAccessible.cpp 
line 829] 
	 nsAccessNode::ClearCacheEntry
[c:/builds/seamonkey/mozilla/accessible/src/base/nsAccessNode.cpp  line 313] 
	 hashEnumerate	[c:/builds/seamonkey/mozilla/xpcom/ds/nsHashtable.cpp  line 121] 
	 PL_DHashTableEnumerate	[c:/builds/seamonkey/mozilla/xpcom/ds/pldhash.c  line 595] 
	 nsHashtable::Enumerate	[c:/builds/seamonkey/mozilla/xpcom/ds/nsHashtable.cpp 
line 304] 
	 nsAccessNode::ClearCache
[c:/builds/seamonkey/mozilla/accessible/src/base/nsAccessNode.cpp  line 319] 
	 nsDocAccessible::Shutdown
[c:/builds/seamonkey/mozilla/accessible/src/base/nsDocAccessible.cpp  line 292] 
	 nsDocAccessible::Destroy
[c:/builds/seamonkey/mozilla/accessible/src/base/nsDocAccessible.cpp  line 263] 
	 nsWindow::~nsWindow
[c:/builds/seamonkey/mozilla/widget/src/windows/nsWindow.cpp  line 824] 
	 nsWindow::`scalar deleting destructor'  
	 nsWindow::Release	[c:/builds/seamonkey/mozilla/widget/src/windows/nsWindow.cpp
 line 699] 
	 nsCOMPtr_base::~nsCOMPtr_base
[c:/builds/seamonkey/mozilla/xpcom/glue/nsCOMPtr.cpp  line 66] 
	 DocumentViewerImpl::~DocumentViewerImpl
[c:/builds/seamonkey/mozilla/content/base/src/nsDocumentViewer.cpp  line 564] 
	 DocumentViewerImpl::Show
[c:/builds/seamonkey/mozilla/content/base/src/nsDocumentViewer.cpp  line 1370] 
	 0x8b0c247c   
 
     (19842983)	URL: www.tomshardware.com
     (19840204)	URL: www.tomshardware.com
 
====================================================================================================
     Count   Offset    Real Signature
[ 1   nsAccessibilityService::GetAccessible a27b25c5 -
nsAccessibilityService::GetAccessible ]
 
     Crash date range: 2003-05-06 to 2003-05-06
 
     Count   Platform List 
     1   Windows 98 4.10 build 67766446
 
     Count   Build Id List 
     1   2003050211
 
     No of Unique Users         1
 
 Stack trace(Frame) 

	 nsAccessibilityService::GetAccessible
[c:/builds/seamonkey/mozilla/accessible/src/base/nsAccessibilityService.cpp 
line 1625] 
	 nsAccessibilityService::GetAccessibleInWeakShell
[c:/builds/seamonkey/mozilla/accessible/src/base/nsAccessibilityService.cpp 
line 1508] 
	 nsAccessibleTreeWalker::GetAccessible
[c:/builds/seamonkey/mozilla/accessible/src/base/nsAccessibleTreeWalker.cpp 
line 338] 
	 nsSupportsWeakReference::GetWeakReference
[c:/builds/seamonkey/mozilla/xpcom/glue/nsWeakReference.cpp  line 90] 
	 nsAccessibleTreeWalker::GetNextSibling
[c:/builds/seamonkey/mozilla/accessible/src/base/nsAccessibleTreeWalker.cpp 
line 237] 
	 nsAccessible::GetAccNextSibling
[c:/builds/seamonkey/mozilla/accessible/src/base/nsAccessible.cpp  line 282] 
	 nsAccessible::Shutdown
[c:/builds/seamonkey/mozilla/accessible/src/base/nsAccessible.cpp  line 222] 
	 nsHTMLComboboxAccessible::Init
[c:/builds/seamonkey/mozilla/accessible/src/html/nsHTMLSelectAccessible.cpp 
line 836] 
	 nsAccessNode::ClearCacheEntry
[c:/builds/seamonkey/mozilla/accessible/src/base/nsAccessNode.cpp  line 313] 
	 hashEnumerateShare	[c:/builds/seamonkey/mozilla/xpcom/ds/nsHashtable.cpp  line
280] 
	 PL_DHashTableRawRemove	[c:/builds/seamonkey/mozilla/xpcom/ds/pldhash.c  line 569] 
	 nsHashtable::Clone	[c:/builds/seamonkey/mozilla/xpcom/ds/nsHashtable.cpp  line
291] 
	 nsAccessNode::ClearCache
[c:/builds/seamonkey/mozilla/accessible/src/base/nsAccessNode.cpp  line 319] 
	 nsDocAccessible::Shutdown
[c:/builds/seamonkey/mozilla/accessible/src/base/nsDocAccessible.cpp  line 292] 
	 nsDocAccessible::Destroy
[c:/builds/seamonkey/mozilla/accessible/src/base/nsDocAccessible.cpp  line 263] 
	 0x088b0674   
 
 
====================================================================================================
     Count   Offset    Real Signature
[ 1   nsAccessibilityService::GetAccessible 15c63b5f -
nsAccessibilityService::GetAccessible ]
 
     Crash date range: 2003-05-07 to 2003-05-07
 
     Count   Platform List 
     1   Windows NT 5.1 build 2600
 
     Count   Build Id List 
     1   2003050714
 
     No of Unique Users         1
 
 Stack trace(Frame) 

	 nsAccessibilityService::GetAccessible
[c:/builds/seamonkey/mozilla/accessible/src/base/nsAccessibilityService.cpp 
line 1625] 
	 nsAccessibilityService::GetAccessibleInWeakShell
[c:/builds/seamonkey/mozilla/accessible/src/base/nsAccessibilityService.cpp 
line 1508] 
	 nsAccessibleTreeWalker::GetAccessible
[c:/builds/seamonkey/mozilla/accessible/src/base/nsAccessibleTreeWalker.cpp 
line 338] 
	 nsCOMPtr_base::assign_with_AddRef
[c:/builds/seamonkey/mozilla/xpcom/glue/nsCOMPtr.cpp  line 71] 
	 nsAccessibleTreeWalker::GetNextSibling
[c:/builds/seamonkey/mozilla/accessible/src/base/nsAccessibleTreeWalker.cpp 
line 232] 
	 nsAccessible::GetAccNextSibling
[c:/builds/seamonkey/mozilla/accessible/src/base/nsAccessible.cpp  line 280] 
	 nsAccessible::Shutdown
[c:/builds/seamonkey/mozilla/accessible/src/base/nsAccessible.cpp  line 220] 
	 nsHTMLComboboxAccessible::Shutdown
[c:/builds/seamonkey/mozilla/accessible/src/html/nsHTMLSelectAccessible.cpp 
line 829] 
	 nsAccessNode::ClearCacheEntry
[c:/builds/seamonkey/mozilla/accessible/src/base/nsAccessNode.cpp  line 313] 
	 hashEnumerate	[c:/builds/seamonkey/mozilla/xpcom/ds/nsHashtable.cpp  line 121] 
	 PL_DHashTableEnumerate	[c:/builds/seamonkey/mozilla/xpcom/ds/pldhash.c  line 595] 
	 nsHashtable::Enumerate	[c:/builds/seamonkey/mozilla/xpcom/ds/nsHashtable.cpp 
line 304] 
	 nsAccessNode::ClearCache
[c:/builds/seamonkey/mozilla/accessible/src/base/nsAccessNode.cpp  line 319] 
	 nsDocAccessible::Shutdown
[c:/builds/seamonkey/mozilla/accessible/src/base/nsDocAccessible.cpp  line 292] 
	 nsDocAccessible::Destroy
[c:/builds/seamonkey/mozilla/accessible/src/base/nsDocAccessible.cpp  line 263] 
	 nsWindow::~nsWindow
[c:/builds/seamonkey/mozilla/widget/src/windows/nsWindow.cpp  line 825] 
	 nsWindow::`scalar deleting destructor'  
	 nsWindow::Release	[c:/builds/seamonkey/mozilla/widget/src/windows/nsWindow.cpp
 line 700] 
	 nsCOMPtr_base::~nsCOMPtr_base
[c:/builds/seamonkey/mozilla/xpcom/glue/nsCOMPtr.cpp  line 66] 
	 DocumentViewerImpl::~DocumentViewerImpl
[c:/builds/seamonkey/mozilla/content/base/src/nsDocumentViewer.cpp  line 564] 
	 XPCJSRuntime::GCCallback
[c:/builds/seamonkey/mozilla/js/src/xpconnect/src/xpcjsruntime.cpp  line 543] 
	 0xec8b5500
Severity: normal → critical
Attachment #122988 - Flags: review?(kyle.yuan)
Comment on attachment 122988 [details] [diff] [review]
Add null checks. Also, avoid creating new child accessibles while getting children to set their mParent=nsnull;

> NS_IMETHODIMP nsHTMLComboboxAccessible::Shutdown()
> {
>+  nsHTMLSelectableAccessible::Shutdown();
>+
>   mComboboxTextFieldAccessible = nsnull;
>   mComboboxButtonAccessible = nsnull;
>   mComboboxListAccessible = nsnull;
>-
>-  nsHTMLSelectableAccessible::Shutdown();
> 
>   return NS_OK;
> }

Is this a common rule that call base class's Shutdown before any other things?
If so, there are some other classes that override Shutdown method, we should
also take care of them.
Kyle, no it's not the common rule.

I want to switch the order only for HTMLCombobox. The strong references to
children should go away only after they might be used by
nsAccessible::Shutdown(). The crash is probably fixed by the other things
already, but this is another precaution.
Updated summary with M140B since this is a topcrasher for Mozilla 1.4 Beta. 
It's the #7 crash so far and since Aaron has proposed a patch for some null
checks, making this topcrash+ and nominating for 1.4 final.
Flags: blocking1.4?
Keywords: topcrash → topcrash+
Summary: trunk topcrash [@ nsAccessibilityService::GetAccessible] → Trunk M140B topcrash [@ nsAccessibilityService::GetAccessible]
Kyle, are you still planning to review this one?
Comment on attachment 122988 [details] [diff] [review]
Add null checks. Also, avoid creating new child accessibles while getting children to set their mParent=nsnull;

r=kyle, sorry for late
Attachment #122988 - Flags: review?(kyle.yuan) → review+
Attachment #122988 - Flags: superreview?(alecf)
Comment on attachment 122988 [details] [diff] [review]
Add null checks. Also, avoid creating new child accessibles while getting children to set their mParent=nsnull;

should we move these assertions up so they still fire?
Attachment #122988 - Flags: superreview?(alecf) → superreview+
Comment on attachment 122988 [details] [diff] [review]
Add null checks. Also, avoid creating new child accessibles while getting children to set their mParent=nsnull;

should we move these assertions up so they still fire?
sr=alecf
Attachment #122988 - Flags: approval1.4?
Alec, I don't want those assertions any more since I believe it's a legitimate
condition.
Comment on attachment 122988 [details] [diff] [review]
Add null checks. Also, avoid creating new child accessibles while getting children to set their mParent=nsnull;

a=asa (on behalf of drivers) for checkin to 1.4
Attachment #122988 - Flags: approval1.4? → approval1.4+
checked in
Status: NEW → RESOLVED
Closed: 21 years ago
Resolution: --- → FIXED
*** Bug 206331 has been marked as a duplicate of this bug. ***
Flags: blocking1.4?
Crash Signature: [@ nsAccessibilityService::GetAccessible]
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: