Closed Bug 296429 Opened 15 years ago Closed 15 years ago

FF11a1 crash using Windows-Eyes [@ nsHTMLComboboxAccessible::GetFocusedOptionAccessible]

Categories

(Core :: Disability Access APIs, defect, critical)

x86
Windows XP
defect
Not set
critical

Tracking

()

RESOLVED FIXED

People

(Reporter: jay, Assigned: aaronlev)

Details

(Keywords: crash, topcrash+)

Crash Data

Attachments

(1 file)

This appears to be a topcrasher in early Deer Park alpha 1 Talkback data.  Most
likely just a couple of users crashing, but the cause seems pretty clear:
Windows-Eyes.  Here is a recent incident:

Incident ID: 6300538
Stack Signature	nsHTMLComboboxAccessible::GetFocusedOptionAccessible d1f90713
Product ID	FirefoxTrunk
Build ID	2005053112
Trigger Time	2005-06-01 08:01:53.0
Platform	Win32
Operating System	Windows NT 5.1 build 2600
Module	firefox.exe + (003b0e4e)
URL visited	(private address)
User Comments	GPF with Window-Eyes
Since Last Crash	100 sec
Total Uptime	175 sec
Trigger Reason	Access violation
Source File, Line No.
c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/accessible/src/html/nsHTMLSelectAccessible.cpp,
line 892
Stack Trace 	
nsHTMLComboboxAccessible::GetFocusedOptionAccessible 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/accessible/src/html/nsHTMLSelectAccessible.cpp,
line 892]
nsHTMLComboboxAccessible::GetValue 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/accessible/src/html/nsHTMLSelectAccessible.cpp,
line 916]
nsAccessible::GetFinalValue 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/accessible/src/base/nsAccessible.cpp,
line 1604]
nsAccessibleWrap::get_accValue 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/accessible/src/msaa/nsAccessibleWrap.cpp,
line 262]
GWM32INC.dll + 0x5fb0 (0x03455fb0)
GWM32INC.dll + 0x861e (0x0345861e)
GWM32INC.dll + 0x952a (0x0345952a)
GWM32INC.dll + 0x96c4 (0x034596c4)
GWM32INC.dll + 0x965e (0x0345965e)
USER32.dll + 0x4902c (0x77d8902c)
ntdll.dll + 0xeae3 (0x7c90eae3)
nsAccessible::FireToolkitEvent 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/accessible/src/base/nsAccessible.cpp,
line 1383]
nsDocAccessible::InvalidateCacheSubtree 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/accessible/src/base/nsDocAccessible.cpp,
line 959]
nsDocAccessible::HandleMutationEvent 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/accessible/src/base/nsDocAccessible.cpp,
line 1013]
nsDocAccessible::NodeInserted 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/accessible/src/base/nsDocAccessible.cpp,
line 697]
nsEventListenerManager::HandleEvent 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/content/events/src/nsEventListenerManager.cpp,
line 1662]
nsXULDocument::HandleDOMEvent 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/content/xul/document/src/nsXULDocument.cpp,
line 1237]
nsXULElement::HandleDOMEvent 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2176]
nsXULElement::HandleDOMEvent 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2173]
nsXULElement::HandleDOMEvent 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2173]
nsXULElement::HandleDOMEvent 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2173]
nsXULElement::HandleDOMEvent 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2173]
nsXULElement::HandleDOMEvent 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2173]
nsXULElement::HandleDOMEvent 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2173]
nsXULElement::HandleDOMEvent 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2173]
nsXULElement::HandleChromeEvent 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2869]
nsGlobalWindow::HandleDOMEvent 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/dom/src/base/nsGlobalWindow.cpp,
line 903]
nsDocument::HandleDOMEvent 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/content/base/src/nsDocument.cpp,
line 3958]
nsGenericElement::HandleDOMEvent 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/content/base/src/nsGenericElement.cpp,
line 2085]
nsGenericElement::HandleDOMEvent 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/content/base/src/nsGenericElement.cpp,
line 2079]
nsGenericElement::HandleDOMEvent 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/content/base/src/nsGenericElement.cpp,
line 2079]
nsGenericElement::HandleDOMEvent 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/content/base/src/nsGenericElement.cpp,
line 2079]
nsGenericElement::HandleDOMEvent 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/content/base/src/nsGenericElement.cpp,
line 2079]
nsGenericElement::HandleDOMEvent 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/content/base/src/nsGenericElement.cpp,
line 2079]
nsGenericElement::HandleDOMEvent 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/content/base/src/nsGenericElement.cpp,
line 2079]
nsGenericElement::HandleDOMEvent 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/content/base/src/nsGenericElement.cpp,
line 2079]
nsHTMLFormElement::HandleDOMEvent 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/content/html/content/src/nsHTMLFormElement.cpp,
line 691]
nsGenericElement::HandleDOMEvent 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/content/base/src/nsGenericElement.cpp,
line 2079]
nsGenericElement::HandleDOMEvent 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/content/base/src/nsGenericElement.cpp,
line 2079]
nsGenericElement::HandleDOMEvent 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/content/base/src/nsGenericElement.cpp,
line 2079]
nsGenericElement::HandleDOMEvent 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/content/base/src/nsGenericElement.cpp,
line 2079]
nsGenericElement::HandleDOMEvent 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/content/base/src/nsGenericElement.cpp,
line 2079]
nsHTMLSelectElement::HandleDOMEvent 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/content/html/content/src/nsHTMLSelectElement.cpp,
line 1764]
nsGenericElement::HandleDOMEvent 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/content/base/src/nsGenericElement.cpp,
line 2079]
nsGenericElement::AppendChildTo 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/content/base/src/nsGenericElement.cpp,
line 2760]
nsHTMLSelectElement::AppendChildTo 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/content/html/content/src/nsHTMLSelectElement.cpp,
line 491]
HTMLContentSink::OpenContainer 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/content/html/document/src/nsHTMLContentSink.cpp,
line 2956]
CNavDTD::HandleDefaultStartToken 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/parser/htmlparser/src/CNavDTD.cpp,
line 1334]
CNavDTD::HandleStartToken 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/parser/htmlparser/src/CNavDTD.cpp,
line 1711]
CNavDTD::HandleToken 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/parser/htmlparser/src/CNavDTD.cpp,
line 954]
CNavDTD::BuildModel 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/parser/htmlparser/src/CNavDTD.cpp,
line 461]
nsParser::BuildModel 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/parser/htmlparser/src/nsParser.cpp,
line 2083]

More crashes of this type can be found here:
http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=1&searchby=stacksig&match=contains&searchfor=nsHTMLComboboxAccessible::GetFocusedOptionAccessible&vendor=MozillaOrg&product=FirefoxTrunk&platform=All&buildid=&sdate=&stime=&edate=&etime=&sortby=bbid
Assignee: nobody → aaronleventhal
Status: NEW → ASSIGNED
Attachment #185237 - Flags: superreview?(neil.parkwaycc.co.uk)
Attachment #185237 - Flags: review?(timeless)
Comment on attachment 185237 [details] [diff] [review]
Accessible couldn't get created for non-visible drop down,. Get content via frame instead, which is faster anyway.

>+  nsCOMPtr<nsIComboboxControlFrame> cbxFrame = do_QueryInterface(GetFrame());
Frames don't go in nsCOMPtr, fix this for sr=me.
Attachment #185237 - Flags: superreview?(neil.parkwaycc.co.uk) → superreview+
Attachment #185237 - Flags: review?(timeless) → review+
Component: Disability Access → Disability Access APIs
Flags: review+
Product: Firefox → Core
Attachment #185237 - Flags: review+
Comment on attachment 185237 [details] [diff] [review]
Accessible couldn't get created for non-visible drop down,. Get content via frame instead, which is faster anyway.

I will address Neil's comment.
Attachment #185237 - Flags: approval1.8b3?
Flags: blocking1.8b3?
Marking topcrash+ since we have a patch and nominating for 1.8b3
Flags: blocking1.8b3?
Keywords: topcrashtopcrash+
Flags: blocking1.8b3?
Attachment #185237 - Flags: approval1.8b3? → approval1.8b3+
Checking in nsHTMLSelectAccessible.cpp;
/cvsroot/mozilla/accessible/src/html/nsHTMLSelectAccessible.cpp,v  <-- 
nsHTMLSelectAccessible.cpp
new revision: 1.45; previous revision: 1.44
done
Status: ASSIGNED → RESOLVED
Closed: 15 years ago
Resolution: --- → FIXED
Flags: blocking1.8b3?
Crash Signature: [@ nsHTMLComboboxAccessible::GetFocusedOptionAccessible]
You need to log in before you can comment on or make changes to this bug.