300806 - Crash at shutdown when using an AT

Status: RESOLVED FIXED

(Core :: Disability Access APIs, defect)

Description

[parente]

Run Firefox and an assistive tech. Start in any order. Close the AT then close 
Firefox. Firefox will crash at shutdown with an access violation at http://lxr.
mozilla.org/seamonkey/source/accessible/src/base/nsAccessible.cpp#383

Closing Firefox first and then the AT does not result in a crash.

Comment 1

[Aaron Leventhal]

A stack trace would be useful.

Does the talkback report tool come up? If so we should be able to get a crash stack.

Comment 2

[Aaron Leventhal]

(In reply to comment #1)
> A stack trace would be useful.
> 
> Does the talkback report tool come up? If so we should be able to get a crash
stack.

Peter, any more info? Was this only with the Python tool?

Comment 3

[parente]

The crash occurs only with the Python tool. I only get the VS debug dialog when 
it happens.

According to VS, death occurs in the nsAccessible::Shutdown method (http://lxr.
mozilla.org/seamonkey/source/accessible/src/base/nsAccessible.cpp#383) while 
enumerating one of the caches and clearing out entries.

The relevant part of the VS stack trace is below, though I'm sure Bugzilla is 
going to mangle it:

 	accessibility.dll!nsCOMPtr<nsIAccessible>::
nsCOMPtr<nsIAccessible>(nsIAccessible * aRawPtr=0x0354f128)  Line 627 + 0xd	
C++
 	accessibility.dll!nsAccessible::Shutdown()  Line 383 + 0xf	C++
>	accessibility.dll!nsAccessNode::ClearCacheEntry(const void * 
aKey=0x02e86f04, nsCOMPtr<nsIAccessNode> & aAccessNode={...}, void * 
aUserArg=0x00000000)  Line 533	C++
 	accessibility.dll!nsBaseHashtable<nsVoidHashKey,nsCOMPtr<nsIAccessNode>,
nsIAccessNode *>::s_EnumStub(PLDHashTable * table=0x03530458, PLDHashEntryHdr * 
hdr=0x03530bc8, unsigned int number=37, void * arg=0x0012e0e8)  Line 349 + 
0x1c	C++
 	xpcom_core.dll!PL_DHashTableEnumerate(PLDHashTable * table=0x03530458, 
PLDHashOperator (PLDHashTable *, PLDHashEntryHdr *, unsigned int, void *)* 
etor=0x042adb30, void * arg=0x0012e0e8)  Line 619 + 0x19	C
 	accessibility.dll!nsBaseHashtable<nsVoidHashKey,nsCOMPtr<nsIAccessNode>,
nsIAccessNode *>::Enumerate(PLDHashOperator (const void *, 
nsCOMPtr<nsIAccessNode> &, void *)* enumFunc=0x042aced0, void * 
userArg=0x00000000)  Line 224 + 0x12	C++
 	accessibility.dll!nsAccessNode::
ClearCache(nsInterfaceHashtable<nsVoidHashKey,nsIAccessNode> & aCache={...})  
Line 539	C++
 	accessibility.dll!nsDocAccessible::Shutdown()  Line 468 + 0xc	C++
 	accessibility.dll!nsDocAccessibleWrap::Shutdown()  Line 173	C++
 	accessibility.dll!nsRootAccessible::Shutdown()  Line 914	C++
 	accessibility.dll!nsDocAccessible::Destroy()  Line 448	C++
 	accessibility.dll!nsRootAccessible::HandleEvent(nsIDOMEvent * 
aEvent=0x03585db4)  Line 518	C++

Comment 4

[Aaron Leventhal]

Peter, I fixed several crash-related bugs last week. Can you still reproduce
this with a branch build? They're here:
http://ftp.mozilla.org/pub/mozilla.org/firefox/nightly/latest-mozilla1.8/

Comment 5

[parente]

Aaron,

Sorry I didn't get back to you sooner. Was on vacation with limited Internet 
access last week.

As of the 8/20 build of the 1.8 branch, it appears that the crashing problem has 
been resolved. I can now close the Python tree explorer tool and then close FF 
without a crash.