Closed Bug 302250 Opened 20 years ago Closed 19 years ago

random crashes in GetMaiAtkType

Categories

(Firefox :: Disability Access, defect)

Product:
Firefox
Component:
Disability Access
Platform:
x86
Linux
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED FIXED

People

(Reporter: luis, Assigned: evan.yan)

References

(
URL
)

Details

(Keywords: crash, fixed1.8.1)

Attachments

(1 file, 3 obsolete files)

patch v4
4.73 KB, patch
ginnchen+exoracle
: review+
roc
: superreview+
aaronlev
: approval-branch-1.8.1+
Details | Diff | Splinter Review
This is HEAD Firefox, against gtk 2.7 and wrapped in epiphany HEAD. I've twice now seen random crashes in the accessibility code while entering text, but relative to the amount of text I enter, it is pretty scarce :) Trace: Backtrace was generated from '/home/louie/jhbuilt/bin/epiphany' Using host libthread_db library "/lib/tls/i686/cmov/libthread_db.so.1". `system-supplied DSO at 0xffffe000' has disappeared; keeping its symbols. [Thread debugging using libthread_db enabled] [New Thread -1228572992 (LWP 17900)] [New Thread -1383859280 (LWP 19396)] [New Thread -1291281488 (LWP 19265)] [New Thread -1272378448 (LWP 18108)] [New Thread -1272112208 (LWP 18107)] [New Thread -1271841872 (LWP 18106)] [New Thread -1269654608 (LWP 18105)] [New Thread -1250141264 (LWP 17902)] [New Thread -1234314320 (LWP 17901)] 0xffffe410 in __kernel_vsyscall () #0 0xffffe410 in __kernel_vsyscall () #1 0xb704afcb in __waitpid_nocancel () from /lib/tls/i686/cmov/libpthread.so.0 #2 0xb7e68442 in libgnomeui_segv_handle (signum=-512) at gnome-ui-init.c:749 #3 <signal handler called> #4 IA__g_logv (log_domain=0xb70309bb "GLib-GObject", log_level=G_LOG_LEVEL_ERROR, format=0xb6fd80e0 "file %s: line %d (%s): assertion failed: (%s)", args1=0xbffff07c "­U\003·Ð\001") at gmessages.c:502 #5 0xb6fb1006 in IA__g_log (log_domain=0x89 <Address 0x89 out of bounds>, log_level=137, format=0x89 <Address 0x89 out of bounds>) at gmessages.c:517 #6 0xb6fb10f1 in IA__g_assert_warning ( log_domain=0x89 <Address 0x89 out of bounds>, file=0x89 <Address 0x89 out of bounds>, line=137, pretty_function=0x4 <Address 0x4 out of bounds>, expression=0xb7035b60 "pnode->n_children < MAX_N_CHILDREN") at gmessages.c:552 #7 0xb70224f5 in type_node_new_W (pnode=0x119ecf68, name=0x89 <Address 0x89 out of bounds>, plugin=0x89) at gtype.c:464 #8 0xb7026ac5 in IA__g_type_register_static (parent_type=154802024, type_name=0xb16ff9a8 "MaiAtkTypefff", info=0xb16eca00, flags=137) at gtype.c:2274 #9 0xb16ccd85 in GetMaiAtkType () from /home/louie/jhbuilt//lib/firefox-1.0+/components/libaccessibility.so #10 0xb16cde35 in nsAccessibleWrap::GetNativeInterface () from /home/louie/jhbuilt//lib/firefox-1.0+/components/libaccessibility.so #11 0xb16ccc65 in nsAccessibleWrap::GetAtkObject () from /home/louie/jhbuilt//lib/firefox-1.0+/components/libaccessibility.so #12 0xb16cd7ae in refChildCB () from /home/louie/jhbuilt//lib/firefox-1.0+/components/libaccessibility.so #13 0xb79413c3 in atk_object_ref_accessible_child (accessible=0x1382af58, i=137) at atkobject.c:649 #14 0xb69fba35 in spi_atk_bridge_signal_listener (signal_hint=0x0, n_param_values=3, param_values=0xbffff430, data=0x81ad140) at bridge.c:989 #15 0xb702022c in signal_emit_unlocked_R (node=0x81a5f68, detail=883, instance=0x1382af58, emission_return=0x0, instance_and_params=0xbffff430) at gsignal.c:2474 #16 0xb701f0dc in IA__g_signal_emit_valist (instance=0x1382af58, signal_id=0, detail=883, var_args=0xbffff5d0 "") at gsignal.c:2267 #17 0xb701f466 in IA__g_signal_emit_by_name (instance=0x1382af58, detailed_signal=0xb16ecbdf "children_changed::add") at gsignal.c:2335 #18 0xb16ce9a8 in nsDocAccessibleWrap::FireToolkitEvent () from /home/louie/jhbuilt//lib/firefox-1.0+/components/libaccessibility.so #19 0xb16b12d4 in nsDocAccessible::FlushPendingEvents () from /home/louie/jhbuilt//lib/firefox-1.0+/components/libaccessibility.so #20 0xb16b0dd9 in nsDocAccessible::FlushEventsCallback () from /home/louie/jhbuilt//lib/firefox-1.0+/components/libaccessibility.so #21 0xb6d158e3 in nsTimerImpl::Fire () from /home/louie/jhbuilt//lib/firefox-1.0+/libxpcom_core.so #22 0xb6d1623e in handleTimerEvent () from /home/louie/jhbuilt//lib/firefox-1.0+/libxpcom_core.so #23 0xb6d11ea1 in PL_HandleEvent (self=0xb215a028) at plevent.c:685 #24 0xb6d11dd8 in PL_ProcessPendingEvents (self=0x8651aa0) at plevent.c:620 #25 0xb6d135cf in nsEventQueueImpl::ProcessPendingEvents () from /home/louie/jhbuilt//lib/firefox-1.0+/libxpcom_core.so #26 0xb5e349c6 in event_processor_callback () from /home/louie/jhbuilt//lib/firefox-1.0+/components/libwidget_gtk2.so #27 0xb6fce93f in g_io_unix_dispatch (source=0x8764708, callback=0xb5e349b0 <event_processor_callback(_GIOChannel*, GIOCondition, void*)>, user_data=0x89) at giounix.c:162 #28 0xb6fa8172 in g_main_dispatch (context=0x8179328) at gmain.c:1934 #29 0xb6fa91e8 in IA__g_main_context_dispatch (context=0x8179328) at gmain.c:2484 #30 0xb6fa9520 in g_main_context_iterate (context=0x8179328, block=1, dispatch=1, self=0x81445d0) at gmain.c:2565 #31 0xb6fa9ac3 in IA__g_main_loop_run (loop=0x81b1f98) at gmain.c:2769 #32 0xb7b12513 in IA__gtk_main () at gtkmain.c:972 #33 0x0807262c in main (argc=295620456, argv=0x119ecf68) at ephy-main.c:307 Thread 9 (Thread -1234314320 (LWP 17901)): #0 0xffffe410 in __kernel_vsyscall () No symbol table info available. #1 0xb6e034ec in poll () from /lib/tls/i686/cmov/libc.so.6 No symbol table info available. #2 0xb7fb4be9 in _pr_poll_with_poll (pds=0x8652180, npds=1, timeout=4294967295) at ptio.c:3888 in_flags_read = 1 in_flags_write = 0 out_flags_read = 0 out_flags_write = 0 stack_syspoll = {{fd = 24, events = 1, revents = 0}, { fd = -1234316920, events = 1998, revents = -18437}, {fd = -1306784752, events = -9296, revents = -18835}, {fd = -1234316920, events = -7164, revents = -18832}, {fd = -1233590156, events = 3088, revents = -19940}, { fd = -1234316856, events = -1513, revents = -18832}, {fd = -1306784752, events = -22704, revents = 2186}, {fd = -1234316856, events = -1569, revents = -18832}, {fd = 140884400, events = 5760, revents = -18714}, { fd = 24, events = 19648, revents = -19938}, {fd = -1306647612, events = 5760, revents = -18714}, {fd = -1234316840, events = -32636, revents = -18726}, {fd = -1226397188, events = 16, revents = -19952}, { fd = -1306714840, events = -32636, revents = -18726}, {fd = -1226397188, events = 16, revents = -19952}, {fd = -1306716696, events = -11784, revents = -18835}, {fd = -1227191959, events = 16, revents = -19952}, { fd = -1306716696, events = -25392, revents = -18697}, {fd = -1306716696, events = -11972, revents = -19940}, {fd = -1234316776, events = 16433, revents = -18699}, {fd = -1306716696, events = 21824, revents = 4808}, { fd = -1234316776, events = 16410, revents = -18699}, {fd = -1306716696, events = 1968, revents = -18732}, {fd = -1234316744, events = -16842, revents = -18739}, {fd = -1306716696, events = -6028, revents = -18824}, { fd = -1234316712, events = -16900, revents = -18739}, {fd = -1227618384, events = -11972, revents = -19940}, {fd = -1234316712, events = -23278, revents = -18739}, {fd = -1306716696, events = 0, revents = 0}, { fd = -1306647612, events = 1968, revents = -18732}, {fd = -1306734276, events = -12255, revents = -2723}, {fd = -1234316680, events = 25495, revents = -18739}, {fd = 142730044, events = -11972, revents = -19940}, { fd = 142730000, events = 16433, revents = -18699}, {fd = -1306734276, events = 2, revents = 0}, {fd = -1234316616, events = 25676, revents = -18739}, {fd = 142730044, events = -11972, revents = -19940}, { fd = 3, events = -11548, revents = -18835}, {fd = -1227191959, events = 16, revents = -19952}, {fd = 1, events = 12, revents = 0}, { fd = 16, events = 5760, revents = -18714}, {fd = -1306734264, events = 1968, revents = -18732}, {fd = 0, events = -7372, revents = 2177}, {fd = -1234316552, events = -32636, revents = -18726}, { fd = -1226397188, events = -15840, revents = -18714}, {fd = 315064088, events = -11544, revents = -18835}, {fd = -1227191959, events = -15840, revents = -18714}, {fd = 315064088, events = -25392, revents = -18697}, { fd = 315064088, events = 0, revents = 0}, {fd = -1234316536, events = 16433, revents = -18699}, {fd = 315064088, events = 0, revents = 0}, {fd = -1234316520, events = 16410, revents = -18699}, { fd = 0, events = -6028, revents = -18824}, {fd = -1234316504, events = -30579, revents = -18827}, {fd = 315064088, events = -6028, revents = -18824}, {fd = -1234316472, events = -30644, revents = -18827}, {fd = 142730004, events = 1968, revents = -18732}, {fd = -1234316472, events = 7985, revents = -18735}, {fd = 315064088, events = -6028, revents = -18824}, {fd = 142730000, events = 1968, revents = -18732}, { fd = -1227618384, events = 32536, revents = 4807}, {fd = -1234316440, events = -11400, revents = -18835}, {fd = -1208217660, events = 0, revents = 0}, {fd = -1227088714, events = -32635, revents = -18437}} syspoll = (struct pollfd *) 0xb66dd160 index = 1 msecs = -1 ready = 0 start = 1 elapsed = 4294967292 remaining = 4294967292 #3 0xb671272c in nsSocketTransportService::Poll () from /home/louie/jhbuilt//lib/firefox-1.0+/components/libnecko.so No symbol table info available. #4 0xb6712ecf in nsSocketTransportService::Run () from /home/louie/jhbuilt//lib/firefox-1.0+/components/libnecko.so No symbol table info available. #5 0xb6d15066 in nsThread::Main () from /home/louie/jhbuilt//lib/firefox-1.0+/libxpcom_core.so No symbol table info available. #6 0xb7fb6271 in _pt_root (arg=0x8652388) at ptthread.c:220 detached = 0 #7 0xb704527a in start_thread () from /lib/tls/i686/cmov/libpthread.so.0 No symbol table info available. #8 0xb6e0ca3e in clone () from /lib/tls/i686/cmov/libc.so.6 No symbol table info available. Thread 8 (Thread -1250141264 (LWP 17902)): #0 0xffffe410 in __kernel_vsyscall () No symbol table info available. #1 0xb7047976 in pthread_cond_wait@@GLIBC_2.3.2 () from /lib/tls/i686/cmov/libpthread.so.0 No symbol table info available. #2 0xb7fb0b0f in PR_WaitCondVar (cvar=0x85f58b0, timeout=4294967295) at ptsynch.c:405 rv = 1122412576 thred = (PRThread *) 0x880c390 #3 0xb6d17713 in TimerThread::Run () from /home/louie/jhbuilt//lib/firefox-1.0+/libxpcom_core.so No symbol table info available. #4 0xb6d15066 in nsThread::Main () from /home/louie/jhbuilt//lib/firefox-1.0+/libxpcom_core.so No symbol table info available. #5 0xb7fb6271 in _pt_root (arg=0x880c390) at ptthread.c:220 detached = 0 #6 0xb704527a in start_thread () from /lib/tls/i686/cmov/libpthread.so.0 No symbol table info available. #7 0xb6e0ca3e in clone () from /lib/tls/i686/cmov/libc.so.6 No symbol table info available. Thread 7 (Thread -1269654608 (LWP 18105)): #0 0xffffe410 in __kernel_vsyscall () No symbol table info available. #1 0xb6e034ec in poll () from /lib/tls/i686/cmov/libc.so.6 No symbol table info available. #2 0xb6fa9ea6 in g_main_context_poll (context=0xb5b8048, timeout=-1, priority=2147483647, fds=0xfffffffc, n_fds=10) at gmain.c:2867 poll_func = 0xb6e03478 <poll> #3 0xb6fa94a0 in g_main_context_iterate (context=0xb5b8048, block=1, dispatch=1, self=0x8bb7ec8) at gmain.c:2560 got_ownership = -4 max_priority = 2147483647 timeout = -1 some_ready = 10 nfds = 10 allocated_nfds = -1 fds = (GPollFD *) 0xb215db28 #4 0xb6fa9ac3 in IA__g_main_loop_run (loop=0x88d24b8) at gmain.c:2769 got_ownership = -1208001744 self = (GThread *) 0x8bb7ec8 #5 0xb72c3262 in link_io_thread_fn (data=0x0) at linc.c:394 No locals. #6 0xb6fc3c2f in g_thread_create_proxy (data=0x8bb7ec8) at gthread.c:564 No locals. #7 0xb704527a in start_thread () from /lib/tls/i686/cmov/libpthread.so.0 No symbol table info available. #8 0xb6e0ca3e in clone () from /lib/tls/i686/cmov/libc.so.6 No symbol table info available. Thread 6 (Thread -1271841872 (LWP 18106)): #0 0xffffe410 in __kernel_vsyscall () No symbol table info available. #1 0xb7047976 in pthread_cond_wait@@GLIBC_2.3.2 () from /lib/tls/i686/cmov/libpthread.so.0 No symbol table info available. #2 0xb7759d24 in gnome_vfs_thread_pool_wait_for_work (state=0x8739068) at gnome-vfs-thread-pool.c:163 No locals. #3 0xb7759d7f in thread_entry (cast_to_state=0x8739068) at gnome-vfs-thread-pool.c:176 No locals. #4 0xb6fc3c2f in g_thread_create_proxy (data=0xa5c53b8) at gthread.c:564 No locals. #5 0xb704527a in start_thread () from /lib/tls/i686/cmov/libpthread.so.0 No symbol table info available. #6 0xb6e0ca3e in clone () from /lib/tls/i686/cmov/libc.so.6 No symbol table info available. Thread 5 (Thread -1272112208 (LWP 18107)): #0 0xffffe410 in __kernel_vsyscall () No symbol table info available. #1 0xb7047976 in pthread_cond_wait@@GLIBC_2.3.2 () from /lib/tls/i686/cmov/libpthread.so.0 No symbol table info available. #2 0xb7759d24 in gnome_vfs_thread_pool_wait_for_work (state=0x95be668) at gnome-vfs-thread-pool.c:163 No locals. #3 0xb7759d7f in thread_entry (cast_to_state=0x95be668) at gnome-vfs-thread-pool.c:176 No locals. #4 0xb6fc3c2f in g_thread_create_proxy (data=0xbc0d4f0) at gthread.c:564 No locals. #5 0xb704527a in start_thread () from /lib/tls/i686/cmov/libpthread.so.0 No symbol table info available. #6 0xb6e0ca3e in clone () from /lib/tls/i686/cmov/libc.so.6 No symbol table info available. Thread 4 (Thread -1272378448 (LWP 18108)): #0 0xffffe410 in __kernel_vsyscall () No symbol table info available. #1 0xb7047976 in pthread_cond_wait@@GLIBC_2.3.2 () from /lib/tls/i686/cmov/libpthread.so.0 No symbol table info available. #2 0xb7759d24 in gnome_vfs_thread_pool_wait_for_work (state=0x8f05bb8) at gnome-vfs-thread-pool.c:163 No locals. #3 0xb7759d7f in thread_entry (cast_to_state=0x8f05bb8) at gnome-vfs-thread-pool.c:176 No locals. #4 0xb6fc3c2f in g_thread_create_proxy (data=0x82abac8) at gthread.c:564 No locals. #5 0xb704527a in start_thread () from /lib/tls/i686/cmov/libpthread.so.0 No symbol table info available. #6 0xb6e0ca3e in clone () from /lib/tls/i686/cmov/libc.so.6 No symbol table info available. Thread 3 (Thread -1291281488 (LWP 19265)): #0 0xffffe410 in __kernel_vsyscall () No symbol table info available. #1 0xb7047976 in pthread_cond_wait@@GLIBC_2.3.2 () from /lib/tls/i686/cmov/libpthread.so.0 No symbol table info available. #2 0xb7759d24 in gnome_vfs_thread_pool_wait_for_work (state=0x12415bc8) at gnome-vfs-thread-pool.c:163 No locals. #3 0xb7759d7f in thread_entry (cast_to_state=0x12415bc8) at gnome-vfs-thread-pool.c:176 No locals. #4 0xb6fc3c2f in g_thread_create_proxy (data=0x11b23bb0) at gthread.c:564 No locals. #5 0xb704527a in start_thread () from /lib/tls/i686/cmov/libpthread.so.0 No symbol table info available. #6 0xb6e0ca3e in clone () from /lib/tls/i686/cmov/libc.so.6 No symbol table info available. Thread 2 (Thread -1383859280 (LWP 19396)): #0 0xffffe410 in __kernel_vsyscall () No symbol table info available. #1 0xb6e034ec in poll () from /lib/tls/i686/cmov/libc.so.6 No symbol table info available. #2 0xb7fb4be9 in _pr_poll_with_poll (pds=0xad83f388, npds=1, timeout=4294967295) at ptio.c:3888 in_flags_read = 1 in_flags_write = 0 out_flags_read = 0 out_flags_write = 0 stack_syspoll = {{fd = 43, events = 1, revents = 0}, {fd = 778398823, events = 28515, revents = 109}, {fd = 0, events = 272, revents = 0}, { fd = 307124832, events = 2, revents = -11129}, {fd = 1694607552, events = -25120, revents = -18437}, {fd = 268435457, events = -5824, revents = 4779}, {fd = 0, events = 0, revents = 0}, {fd = 0, events = 0, revents = 0}, {fd = 0, events = 0, revents = 0}, {fd = 0, events = 0, revents = 0}, {fd = 0, events = 0, revents = 0}, {fd = -1222127735, events = -12424, revents = -18649}, {fd = -1208393764, events = -3632, revents = -21117}, {fd = -1207996320, events = 24540, revents = -18439}, { fd = -1222127740, events = 24664, revents = -18439}, {fd = -1224404992, events = 7372, revents = -18684}, {fd = -1383861724, events = 9718, revents = -18433}, {fd = -1222127735, events = -12424, revents = -18649}, {fd = -1208393764, events = -3584, revents = -21117}, {fd = -1207996320, events = 24540, revents = -18439}, {fd = -1222127740, events = 24664, revents = -18439}, {fd = -1224404992, events = 4444, revents = -18684}, { fd = -1383861676, events = 9718, revents = -18433}, {fd = -1224461079, events = 24654, revents = -18439}, {fd = 448139, events = 24438, revents = -18439}, {fd = 32, events = 0, revents = 0}, {fd = 0, events = 25, revents = 0}, {fd = -1224460938, events = 9276, revents = -18684}, {fd = -1224470580, events = 102, revents = 0}, { fd = 142875624, events = 7416, revents = -18746}, {fd = 226539140, events = 24467, revents = -18439}, {fd = -1207957448, events = 0, revents = 0}, {fd = -1208170692, events = -3304, revents = -21117}, { fd = -1208014903, events = 6880, revents = -18439}, {fd = -1383861548, events = -24232, revents = -18434}, {fd = 57, events = 7416, revents = -18746}, {fd = 1, events = 0, revents = 0}, {fd = 1, events = -3432, revents = -21117}, {fd = -1227191959, events = -15840, revents = -18714}, {fd = 317268696, events = 4036, revents = -18436}, { fd = 317268696, events = -3372, revents = -21117}, {fd = -1383861592, events = 11784, revents = -18438}, {fd = 0, events = 4036, revents = -18436}, {fd = -1383861560, events = 2582, revents = -18437}, { fd = 317268696, events = -18812, revents = 3456}, {fd = -1383861440, events = -14960, revents = -18436}, {fd = -1208393837, events = 8924, revents = 4841}, {fd = -1383861432, events = 1624, revents = -18437}, { fd = 317268696, events = 4444, revents = -18684}, {fd = -1224404992, events = 17900, revents = 0}, {fd = 19396, events = -3344, revents = -21117}, {fd = 317268696, events = 0, revents = 0}, {fd = 1, events = 5760, revents = -18714}, {fd = -1, events = 0, revents = 0}, { fd = 0, events = 0, revents = 0}, {fd = -1208015087, events = -32636, revents = -18726}, {fd = -1226397188, events = -15840, revents = -18714}, {fd = 316682016, events = -3272, revents = -21117}, {fd = -1227191959, events = -15840, revents = -18714}, {fd = 316682016, events = 4036, revents = -18436}, {fd = 316682016, events = 19397, revents = 0}, { fd = -1383861432, events = 11784, revents = -18438}, {fd = 316682016, events = 4036, revents = -18436}, {fd = -1383861400, events = 1998, revents = -18437}} syspoll = (struct pollfd *) 0xad83f150 index = 1 msecs = -1 ready = 0 start = 2911105776 elapsed = 4294967292 remaining = 4294967292 #3 0xb7fb9c48 in WaitPidDaemonThread (unused=0x0) at uxproces.c:712 pd = {fd = 0x8b3b300, in_flags = 1, out_flags = 1} fd = (PRFileDesc *) 0xfffffffc rv = -4 buf = "\000ó\203­\000\000\000\000¸ó\203­Î\aû·\b1e\b\\\026æ¶H\000\000\000\220ÿ\026²tèx¶\000\000\000\000èó\203­\204\200Ú¶ü©æ¶\020\000\020²èþ\026²èó\203­i\211Ú¶\020\000\020²èþ\026²Ä\017ü·èþ\026²Pl\004·øó\203­\b.ú·èþ\026²Ä\017ü·\030ô\203­Ä\017ü·(d_\b\000\000\000\000(ô\203­Î\aû·" pid = 1 status = 0 op = (struct pr_CreateProcOp *) 0x1 #4 0xb7fb6271 in _pt_root (arg=0x12d5bd78) at ptthread.c:220 detached = 0 #5 0xb704527a in start_thread () from /lib/tls/i686/cmov/libpthread.so.0 No symbol table info available. #6 0xb6e0ca3e in clone () from /lib/tls/i686/cmov/libc.so.6 No symbol table info available. Thread 1 (Thread -1228572992 (LWP 17900)): #0 0xffffe410 in __kernel_vsyscall () No symbol table info available. #1 0xb704afcb in __waitpid_nocancel () from /lib/tls/i686/cmov/libpthread.so.0 No symbol table info available. #2 0xb7e68442 in libgnomeui_segv_handle (signum=-512) at gnome-ui-init.c:749 estatus = 1330795077 in_segv = 1 sa = {__sigaction_handler = {sa_handler = 0, sa_sigaction = 0}, sa_mask = {__val = {9435, 195, 0, 0, 0, 135496332, 320190952, 6, 3221220312, 135187661, 3070429627, 6, 320190952, 0, 3, 0, 0, 0, 3068570108, 3068576288, 3221219528, 2976613930, 327322392, 3068576288, 3221219544, 2976613930, 327322392, 324278368, 3221219560, 2976641208, 327322392, 3221219660}}, sa_flags = -1073747720, sa_restorer = 0xb16bf0b8 <nsBlockAccessible::AddRef()+14>} pid = 0 #3 <signal handler called> No symbol table info available. #4 IA__g_logv (log_domain=0xb70309bb "GLib-GObject", log_level=G_LOG_LEVEL_ERROR, format=0xb6fd80e0 "file %s: line %d (%s): assertion failed: (%s)", args1=0xbffff07c "­U\003·Ð\001") at gmessages.c:502 depth = 1 domain = (GLogDomain *) 0x119ecf68 data = 0x0 log_func = 0x80ecc90 <trap_handler> domain_fatal_mask = 5 test_level = 6 was_recursion = 0 i = 2 #5 0xb6fb1006 in IA__g_log (log_domain=0x89 <Address 0x89 out of bounds>, log_level=137, format=0x89 <Address 0x89 out of bounds>) at gmessages.c:517 No locals. #6 0xb6fb10f1 in IA__g_assert_warning ( log_domain=0x89 <Address 0x89 out of bounds>, file=0x89 <Address 0x89 out of bounds>, line=137, pretty_function=0x4 <Address 0x4 out of bounds>, expression=0xb7035b60 "pnode->n_children < MAX_N_CHILDREN") at gmessages.c:552 No locals. #7 0xb70224f5 in type_node_new_W (pnode=0x119ecf68, name=0x89 <Address 0x89 out of bounds>, plugin=0x89) at gtype.c:464 No locals. #8 0xb7026ac5 in IA__g_type_register_static (parent_type=154802024, type_name=0xb16ff9a8 "MaiAtkTypefff", info=0xb16eca00, flags=137) at gtype.c:2274 node = (TypeNode *) 0x93a1768 type = 0 #9 0xb16ccd85 in GetMaiAtkType () from /home/louie/jhbuilt//lib/firefox-1.0+/components/libaccessibility.so No symbol table info available. #10 0xb16cde35 in nsAccessibleWrap::GetNativeInterface () from /home/louie/jhbuilt//lib/firefox-1.0+/components/libaccessibility.so No symbol table info available. #11 0xb16ccc65 in nsAccessibleWrap::GetAtkObject () from /home/louie/jhbuilt//lib/firefox-1.0+/components/libaccessibility.so No symbol table info available. #12 0xb16cd7ae in refChildCB () from /home/louie/jhbuilt//lib/firefox-1.0+/components/libaccessibility.so No symbol table info available. #13 0xb79413c3 in atk_object_ref_accessible_child (accessible=0x1382af58, i=137) at atkobject.c:649 klass = (AtkObjectClass *) 0x119ecf68 #14 0xb69fba35 in spi_atk_bridge_signal_listener (signal_hint=0x0, n_param_values=3, param_values=0xbffff430, data=0x81ad140) at bridge.c:989 gobject = (GObject *) 0x1382af58 signal_query = {signal_id = 108, signal_name = 0x81a5f50 "children-changed", itype = 135865808, signal_flags = 18, return_type = 4, n_params = 2, param_types = 0x81a5380} name = (const gchar *) 0x81a5f50 "children-changed" detail = (const gchar *) 0x81a04b0 "add" any = {_type = 0x0, _value = 0x0, _release = 72 'H'} c_obj = 0xb16bb0f5 sp = 0x0 ao = (AtkObject *) 0xbffff430 detail1 = 0 detail2 = 0 s_ao = (SpiAccessible *) 0x0 #15 0xb702022c in signal_emit_unlocked_R (node=0x81a5f68, detail=883, instance=0x1382af58, emission_return=0x0, instance_and_params=0xbffff430) at gsignal.c:2474 hook_func = 0xb69fb7f0 <spi_atk_bridge_signal_listener> need_destroy = 1 hook = (GHook *) 0x81ad1f0 accumulator = (SignalAccumulator *) 0x0 emission = {next = 0x0, instance = 0x1382af58, ihint = { signal_id = 108, detail = 883, run_type = G_SIGNAL_RUN_FIRST}, state = EMISSION_HOOK, chain_type = 4} handler_list = (Handler *) 0x0 return_accu = (GValue *) 0x0 accu = {g_type = 0, data = {{v_int = 0, v_uint = 0, v_long = 0, v_ulong = 0, v_int64 = 0, v_uint64 = 0, v_float = 0, v_double = 0, v_pointer = 0x0}, {v_int = 0, v_uint = 0, v_long = 0, v_ulong = 0, v_int64 = 0, v_uint64 = 0, v_float = 0, v_double = 0, v_pointer = 0x0}}} signal_id = 108 max_sequential_handler_number = 319212 return_value_altered = 0 #16 0xb701f0dc in IA__g_signal_emit_valist (instance=0x1382af58, signal_id=0, detail=883, var_args=0xbffff5d0 "") at gsignal.c:2267 _cvalue = (GTypeCValue *) 0xb6e6c258 _flags = 0 _value_type = 68 _vtable = (GTypeValueTable *) 0x813f898 _collect_format = (gchar *) 0x0 _cvalues = {{v_int = 0, v_long = 0, v_int64 = 0, v_double = 0, v_pointer = 0x0}, {v_int = 0, v_long = 0, v_int64 = 0, v_double = 0, v_pointer = 0x0}, {v_int = 0, v_long = 0, v_int64 = 0, v_double = 0, v_pointer = 0x0}, {v_int = 0, v_long = 0, v_int64 = 0, v_double = 0, v_pointer = 0x0}, {v_int = 0, v_long = 0, v_int64 = 0, v_double = 0, v_pointer = 0x0}, {v_int = 0, v_long = 0, v_int64 = 0, v_double = 0, v_pointer = 0x0}, {v_int = 0, v_long = 0, v_int64 = 0, v_double = 0, v_pointer = 0x0}, {v_int = 0, v_long = 0, v_int64 = 0, v_double = 0, v_pointer = 0x0}} _n_values = 1 ptype = 0 static_scope = 327331672 instance_and_params = (GValue *) 0xbffff430 stack_values = {{g_type = 327331272, data = {{v_int = 327331672, v_uint = 327331672, v_long = 327331672, v_ulong = 327331672, v_int64 = 327331672, v_uint64 = 327331672, v_float = 3.29895159e-27, v_double = 1.6172333393097508e-315, v_pointer = 0x1382af58}, { v_int = 0, v_uint = 0, v_long = 0, v_ulong = 0, v_int64 = 0, v_uint64 = 0, v_float = 0, v_double = 0, v_pointer = 0x0}}}, { g_type = 28, data = {{v_int = -1, v_uint = 4294967295, v_long = -1, v_ulong = 4294967295, v_int64 = 4294967295, v_uint64 = 4294967295, v_float = -nan(0x7fffff), v_double = 2.1219957904712067e-314, v_pointer = 0xffffffff}, {v_int = 0, v_uint = 0, v_long = 0, v_ulong = 0, v_int64 = 0, v_uint64 = 0, v_float = 0, v_double = 0, v_pointer = 0x0}}}, {g_type = 68, data = {{v_int = 0, v_uint = 0, v_long = 0, v_ulong = 0, v_int64 = 0, v_uint64 = 0, v_float = 0, v_double = 0, v_pointer = 0x0}, {v_int = 0, v_uint = 0, v_long = 0, v_ulong = 0, v_int64 = 0, v_uint64 = 0, v_float = 0, v_double = 0, v_pointer = 0x0}}}, {g_type = 24, data = {{v_int = -1073744644, v_uint = 3221222652, v_long = -1073744644, v_ulong = 3221222652, v_int64 = 8737851576678348028, v_uint64 = 8737851576678348028, v_float = -1.99966383, v_double = 1.3215211093644714e+276, v_pointer = 0xbffff4fc}, {v_int = -1073744644, v_uint = 3221222652, v_long = -1073744644, v_ulong = 3221222652, v_int64 = 604184288383988988, v_uint64 = 604184288383988988, v_float = -1.99966383, v_double = 2.8005265651171546e-268, v_pointer = 0xbffff4fc}}}, {g_type = 2034439606, data = {{ v_int = -1226390996, v_uint = 3068576300, v_long = -1226390996, v_ulong = 3068576300, v_int64 = 15953478188, v_uint64 = 15953478188, v_float = -6.87713873e-06, v_double = 7.8820655043684597e-314, v_pointer = 0xb6e6c22c}, {v_int = 24, v_uint = 24, v_long = 24, v_ulong = 24, v_int64 = 604197754180206616, v_uint64 = 604197754180206616, v_float = 3.36311631e-44, v_double = 2.8077710267723553e-268, v_pointer = 0x18}}}, { g_type = 3066394304, data = {{v_int = -1073744712, v_uint = 3221222584, v_long = -1073744712, v_ulong = 3221222584, v_int64 = -5270748935755926344, v_uint64 = 13175995137953625272, v_float = -1.99965572, v_double = -1.859394031769169e-44, v_pointer = 0xbffff4b8}, {v_int = -1226397188, v_uint = 3068570108, v_long = -1226397188, v_ulong = 3068570108, v_int64 = -5267309268399904260, v_uint64 = 13179434805309647356, v_float = -6.87432293e-06, v_double = -3.189118721201484e-44, v_pointer = 0xb6e6a9fc}}}, {g_type = 3221222616, data = {{ v_int = -1224600158, v_uint = 3070367138, v_long = -1224600158, v_ulong = 3070367138, v_int64 = -4611698109984926302, v_uint64 = 13835045963724625314, v_float = -7.7536406e-06, v_double = -1.9973151348834581, v_pointer = 0xb70215a2}, { v_int = 149922636, v_uint = 149922636, v_long = 149922636, v_ulong = 149922636, v_int64 = 51689530188, v_uint64 = 51689530188, v_float = 1.44226802e-33, v_double = 2.553802111556483e-313, v_pointer = 0x8efa34c}}}, {g_type = 186, data = {{v_int = 149920392, v_uint = 149920392, v_long = 149920392, v_ulong = 149920392, v_int64 = 643912818700032648, v_uint64 = 643912818700032648, v_float = 1.44206194e-33, v_double = 1.2264820525688031e-265, v_pointer = 0x8ef9a88}, {v_int = -1224631152, v_uint = 3070336144, v_long = -1224631152, v_ulong = 3070336144, v_int64 = -5261304809629049712, v_uint64 = 13185439264080501904, v_float = -7.72545172e-06, v_double = -7.8726165431739829e-44, v_pointer = 0xb7019c90}}}, {g_type = 135922864, data = {{ v_int = -1318138895, v_uint = 2976828401, v_long = -1318138895, v_ulong = 2976828401, v_int64 = -4611697938279773199, v_uint64 = 13835046135429778417, v_float = -3.47494855e-09, v_double = -1.9973532610863425, v_pointer = 0xb16ecbf1}, { v_int = -1224600027, v_uint = 3070367269, v_long = -1224600027, v_ulong = 3070367269, v_int64 = 643903149354128933, v_uint64 = 643903149354128933, v_float = -7.75375975e-06, v_double = 1.2251503380268965e-265, v_pointer = 0xb7021625}}}, { g_type = 3070247300, data = {{v_int = -1073744632, v_uint = 3221222664, v_long = -1073744632, v_ulong = 3221222664, v_int64 = -5261980455078464248, v_uint64 = 13184763618631087368, v_float = -1.99966526, v_double = -7.1998882305141406e-44, v_pointer = 0xbffff508}, {v_int = 135922864, v_uint = 135922864, v_long = 135922864, v_ulong = 135922864, v_int64 = -5661363445474655056, v_uint64 = 12785380628234896560, v_float = 4.63481994e-34, v_double = -1.3944227416161525e-70, v_pointer = 0x81a04b0}}}, {g_type = 3221222656, data = {{ v_int = -1224719996, v_uint = 3070247300, v_long = -1224719996, v_ulong = 3070247300, v_int64 = -5661363451130265212, v_uint64 = 12785380622579286404, v_float = -7.64464858e-06, v_double = -1.3944218318480593e-70, v_pointer = 0xb7004184}, { v_int = -1318138895, v_uint = 2976828401, v_long = -1318138895, v_ulong = 2976828401, v_int64 = -4611697938279773199, v_uint64 = 13835046135429778417, v_float = -3.47494855e-09, v_double = -1.9973532610863425, v_pointer = 0xb16ecbf1}}}, { g_type = 3069794357, data = {{v_int = -1224718696, v_uint = 3070248600, v_long = -1224718696, v_ulong = 3070248600, v_int64 = -5661363442540329320, v_uint64 = 12785380631169222296, v_float = -7.64583092e-06, v_double = -1.3944232136352373e-70, v_pointer = 0xb7004698}, {v_int = 295621144, v_uint = 295621144, v_long = 295621144, v_ulong = 295621144, v_int64 = -5259194669201436136, v_uint64 = 13187549404508115480, v_float = 2.50574849e-28, v_double = -1.0978982472900089e-43, v_pointer = 0x119ed218}}}, {g_type = 2976828399, data = {{ v_int = 108, v_uint = 108, v_long = 108, v_ulong = 108, v_int64 = -4611697528939741076, v_uint64 = 13835046544769810540, v_float = 1.51340234e-43, v_double = -1.9974441528320552, v_pointer = 0x6c}, {v_int = -1224598964, v_uint = 3070368332, v_long = -1224598964, v_ulong = 3070368332, v_int64 = -5661363442540209588, v_uint64 = 12785380631169342028, v_float = -7.75472654e-06, v_double = -1.3944232136544975e-70, v_pointer = 0xb7021a4c}}}, {g_type = 327331272, data = {{v_int = 16, v_uint = 16, v_long = 16, v_ulong = 16, v_int64 = -5263230109099229168, v_uint64 = 13183513964610322448, v_float = 2.24207754e-44, v_double = -5.9556296603924283e-44, v_pointer = 0x10}, {v_int = 9, v_uint = 9, v_long = 9, v_ulong = 9, v_int64 = -5661327217561436151, v_uint64 = 12785416856148115465, v_float = 1.26116862e-44, v_double = -1.4002504062924201e-70, v_pointer = 0x9}}}, {g_type = 3221222760, data = {{ v_int = -1073744560, v_uint = 3221222736, v_long = -1073744560, v_ulong = 3221222736, v_int64 = 7811889806283109712, v_uint64 = 7811889806283109712, v_float = -1.99967384, v_double = 1.7106986753696304e+214, v_pointer = 0xbffff550}, { v_int = 1852142180, v_uint = 1852142180, v_long = 1852142180, v_ulong = 1852142180, v_int64 = 7018969280782103140, v_uint64 = 7018969280782103140, v_float = 1.77525893e+28, v_double = 1.7143796335818567e+161, v_pointer = 0x6e657264}}}, { g_type = 1684367214, data = {{v_int = 140672512, v_uint = 140672512, v_long = 140672512, v_ulong = 140672512, v_int64 = -5258959373868040704, v_uint64 = 13187784699841510912, v_float = 6.81575134e-34, v_double = -1.1447541338349434e-43, v_pointer = 0x8627e00}, {v_int = -1073744504, v_uint = 3221222792, v_long = -1073744504, v_ulong = 3221222792, v_int64 = -5259478542139263608, v_uint64 = 13187265531570288008, v_float = -1.99968052, v_double = -1.041368787159715e-43, v_pointer = 0xbffff588}}}} free_me = (GValue *) 0x0 signal_return_type = 4 param_values = (GValue *) 0xbffff444 i = 2 n_params = 2 #17 0xb701f466 in IA__g_signal_emit_by_name (instance=0x1382af58, detailed_signal=0xb16ecbdf "children_changed::add") at gsignal.c:2335 detail = 883 signal_id = 108 #18 0xb16ce9a8 in nsDocAccessibleWrap::FireToolkitEvent () from /home/louie/jhbuilt//lib/firefox-1.0+/components/libaccessibility.so No symbol table info available. #19 0xb16b12d4 in nsDocAccessible::FlushPendingEvents () from /home/louie/jhbuilt//lib/firefox-1.0+/components/libaccessibility.so No symbol table info available. #20 0xb16b0dd9 in nsDocAccessible::FlushEventsCallback () from /home/louie/jhbuilt//lib/firefox-1.0+/components/libaccessibility.so No symbol table info available. #21 0xb6d158e3 in nsTimerImpl::Fire () from /home/louie/jhbuilt//lib/firefox-1.0+/libxpcom_core.so No symbol table info available. #22 0xb6d1623e in handleTimerEvent () from /home/louie/jhbuilt//lib/firefox-1.0+/libxpcom_core.so No symbol table info available. #23 0xb6d11ea1 in PL_HandleEvent (self=0xb215a028) at plevent.c:685 result = (void *) 0x8651aa0 #24 0xb6d11dd8 in PL_ProcessPendingEvents (self=0x8651aa0) at plevent.c:620 event = (PLEvent *) 0x89 count = 2 #25 0xb6d135cf in nsEventQueueImpl::ProcessPendingEvents () from /home/louie/jhbuilt//lib/firefox-1.0+/libxpcom_core.so No symbol table info available. #26 0xb5e349c6 in event_processor_callback () from /home/louie/jhbuilt//lib/firefox-1.0+/components/libwidget_gtk2.so No symbol table info available. #27 0xb6fce93f in g_io_unix_dispatch (source=0x8764708, callback=0xb5e349b0 <event_processor_callback(_GIOChannel*, GIOCondition, void*)>, user_data=0x89) at giounix.c:162 buffer_condition = 295620456 #28 0xb6fa8172 in g_main_dispatch (context=0x8179328) at gmain.c:1934 dispatch = (gboolean (*)(GSource *, GSourceFunc, gpointer)) 0xb6fce8f0 <g_io_unix_dispatch> was_in_call = 0 user_data = 0x8651a58 callback = 0xb5e349b0 <event_processor_callback(_GIOChannel*, GIOCondition, void*)> cb_funcs = (GSourceCallbackFuncs *) 0xb70044a0 cb_data = 0x8764750 need_destroy = 135545104 source = (GSource *) 0x8764708 depth = (gint *) 0x818d4e8 i = 0 #29 0xb6fa91e8 in IA__g_main_context_dispatch (context=0x8179328) at gmain.c:2484 No locals. #30 0xb6fa9520 in g_main_context_iterate (context=0x8179328, block=1, dispatch=1, self=0x81445d0) at gmain.c:2565 got_ownership = 137 max_priority = 2147483647 timeout = 126 some_ready = 1 nfds = 1 allocated_nfds = 126 fds = (GPollFD *) 0x9a9d1f0 #31 0xb6fa9ac3 in IA__g_main_loop_run (loop=0x81b1f98) at gmain.c:2769 got_ownership = 0 self = (GThread *) 0x81445d0 #32 0xb7b12513 in IA__gtk_main () at gtkmain.c:972 tmp_list = (GList *) 0x0 functions = (GList *) 0x0 init = (GtkInitFunction *) 0x0 loop = (GMainLoop *) 0x81b1f98 #33 0x0807262c in main (argc=295620456, argv=0x119ecf68) at ephy-main.c:307 context = 0x8147a60 context_as_value = {g_type = 68, data = {{v_int = 135559776, v_uint = 135559776, v_long = 135559776, v_ulong = 135559776, v_int64 = 135559776, v_uint64 = 135559776, v_float = 4.46809811e-34, v_double = 6.6975428279534713e-316, v_pointer = 0x8147a60}, {v_int = 0, v_uint = 0, v_long = 0, v_ulong = 0, v_int64 = 0, v_uint64 = 0, v_float = 0, v_double = 0, v_pointer = 0x0}}} program = (GnomeProgram *) 0x50 startup_flags = 134685040 args = (const char **) 0x50 string_arg = 0x0 user_time = 150652786 new_instance = 137 err = (GError *) 0x0 #0 0xffffe410 in __kernel_vsyscall ()
Assignee: nobody → yinbolian
URL: http://bonsai.mozilla.org/cvsblame.cg...
Keywords: crash
Every crash I've had in Firefox 1.5 has been in this routine, approximately one every 4 days: TB12934786E, TB12822352W, TB12690691W, TB12499680H, and TB12309736H. (I think TB12156428E was also but it's no longer in the database.) On another similarly-configured machine I've also had TB12884150Z. As can be seen in the comments, the crashes have happened at random times. I've also had crashes in this routine in the Thunderbird 1.5 betas, talkbacks TB12862154X, TB12717731Z, TB12550030W, and TB12366086H, plus TB12225929M and TB12076817G which are no longer in the database either.
Flags: blocking1.8.0.1?
no patch, no trunk testing. If you get a reviewed patch you can ask for approval on the patch, but the bug itself is not blocking 1.8.0.1
Flags: blocking1.8.0.1? → blocking1.8.0.1-
I think I've figured this one out. It appears that for EACH accessible wrapper object, mozilla registers a unique GType deriving from MAI_TYPE_ATK_OBJECT, see http://lxr.mozilla.org/seamonkey/source/accessible/src/atk/nsAccessibleWrap.cpp#421 and http://lxr.mozilla.org/seamonkey/source/accessible/src/atk/nsAccessibleWrap.cpp#436 . This is obviously bad for memory consumption (since registered types occupy memory that'll never be freed again while the program runs), but even worse, gobject limits the number of types that can directly derive from any given object type to 4095. So when we come to register MaiAtkTypefff (fff is the uniquified part), we hit the assertion in http://cvs.gnome.org/viewcvs/*checkout*/glib/gobject/gtype.c?rev=1.85 : type_node_new_W : g_assert (pnode->n_children < MAX_N_CHILDREN); and crash. If the program runs long enough, this will ALWAYS happen. (Sooner if you make heavy use of a11y.)
chpe, I added a printf in GetUniqueMaiAtkTypeName(void) and used a11y heavily. I saw MaiAtkType15ff was used. But still no crash and everything's well. Did I miss something?
(In reply to comment #4) > chpe, > > I added a printf in GetUniqueMaiAtkTypeName(void) and used a11y heavily. > I saw MaiAtkType15ff was used. But still no crash and everything's well. > > Did I miss something? Maybe your glib/gobject libraries have assertions compiled out (compiled with --enable-debug=no) ? In a --enable-debug=minimum or =yes gobject build, the following testcase aborts at 4095 types: http://www.gnome.org/~chpe/testcases/testlimits.c
Reproduced. Thanks, chpe!
May I suggest adding the "topcrash+" keyword to this bug? By my reading of the talkback summaries it is the second-most-reported Linux crash for Firefox 1.5.0.1 (423 occurrences in the 01-24-15 summary). It also affects Thunderbird, where it's the second-most-reported Linux crash in 1.5 (114 occurrences in the 12-01-13 report). As far as I can tell most of the information recommended by http://wiki.mozilla.org/Talkback_Topcrash_Analysis has already been added to this report; given that it's been fairly clearly identified and reproduced at Sun "topcrash+" seems more appropriate than just "topcrash".
Blocks: fox2access
Attached patch patch (obsolete) — — Splinter Review
when the accessibleWrap object has the same MaiInterfaces, reuse the registered gtype, other than register a new one.
Attachment #219113 - Flags: review?(aaronleventhal)
Assignee: yinbolian → Evan.Yan
Comment on attachment 219113 [details] [diff] [review] patch >+ for (int index = 0; index < MAI_INTERFACE_NUM; index++) { >+ if (interfaces[index]) >+ atkTypeNameId |= 1 << index; >+ } Currently MAI_INTERFACE_NUM is 10, so this will fit into the 4095 types allowed; but since in future that might change, so maybe we should add an assertion that atkTypeNameId < 4095 or maybe just that MAI_INTERFACE_NUM < 12 ?
I will wait for the answer to chpe's question before reviewing.
To be honest I don't understand what this code is doing. More comments would be very helpful. Also, we want to avoid sprintf because it sets of warnings in terms of buffer overflow attacks. We have a safe version of that for use in Mozilla, so we should never actually see sprintf. PR_snprintf defined here: http://lxr.mozilla.org/seamonkey/source/nsprpub/pr/src/io/prprf.c#1151
(In reply to comment #9) > (From update of attachment 219113 [details] [diff] [review] [edit]) > >+ for (int index = 0; index < MAI_INTERFACE_NUM; index++) { > >+ if (interfaces[index]) > >+ atkTypeNameId |= 1 << index; > >+ } > > Currently MAI_INTERFACE_NUM is 10, so this will fit into the 4095 types > allowed; but since in future that might change, so maybe we should add an > assertion that atkTypeNameId < 4095 or maybe just that MAI_INTERFACE_NUM < 12 ? > atkTypeNameId doesn't need to below 4095, MAI_INTERFACE_NUM doesn't need to below 12 either. The numer of class nsAccessibleXXX that implements different combination of MAI interfaces NEED to below 4095. I don't think this could happen in near future since the total number of class nsAccessibleXXX is far below 4095. Anyway, we can add a count here to avoid crash if MAI_INTERFACE_NUM grows up to 12.
Attached patch patch v2 (obsolete) — — Splinter Review
refined according to chpe and Aaron's advice. The root cause of this bug is that we register different GTypes for every accessibleWrap object, then it may exceed the GType register number limit sometimes. The members we used to register a GType are MaiInterface::GetAtkType() and MaiInterface::GetInterfaceInfo(), which is the same with different MaiInterface objects. So we can reuse the registered GType when accessibleWrap objects having the same MaiInterface types.
Attachment #219113 - Attachment is obsolete: true
Attachment #219249 - Flags: review?(aaronleventhal)
Attachment #219113 - Flags: review?(aaronleventhal)
Attached patch patch v3 (obsolete) — — Splinter Review
add a count to avoid crash if we registered more than 4095 GTypes.
Attachment #219249 - Attachment is obsolete: true
Attachment #219252 - Flags: review?(aaronleventhal)
Attachment #219249 - Flags: review?(aaronleventhal)
Attached patch patch v4 — — Splinter Review
To avoid crash, if 4095 types have already been registered, do not register any more, just return null, and call NS_ENSURE_TRUE in the invoking function GetNativeInterface().
Attachment #219252 - Attachment is obsolete: true
Attachment #219260 - Flags: review?(aaronleventhal)
Attachment #219252 - Flags: review?(aaronleventhal)
Still looking at this. I need to understand GType's and the Mai plumbing better to be able to review this.
Evan, sorry to be a little slow on this -- can you explain how GType type information is used by Mai? Does everything that supports ATK need to use it?
(In reply to comment #17) > Evan, sorry to be a little slow on this -- can you explain how GType type > information is used by Mai? Does everything that supports ATK need to use it? > to my knowledge, registering GType in GetMaiAtkType() is to let the objects could be used in other applications like GOK through GObject system. It is called by the ATK callback functions, like refChildCB().
Comment on attachment 219260 [details] [diff] [review] patch v4 Ginn is a better reviewer until I understand this code better.
Attachment #219260 - Flags: review?(aaronleventhal) → review?(ginn.chen)
Comment on attachment 219260 [details] [diff] [review] patch v4 r=me besides it should be return 0; instead of return NULL; GType is not a pointer
Attachment #219260 - Flags: review?(ginn.chen) → review+
Attachment #219260 - Flags: superreview?(bzbarsky)
I'm not really a good choice to sr this; I know nothing about any of this stuff. Maybe try roc?
Attachment #219260 - Flags: superreview?(bzbarsky) → superreview?(roc)
Attachment #219260 - Flags: superreview?(roc) → superreview+
Checking in nsAccessibleWrap.cpp; /cvsroot/mozilla/accessible/src/atk/nsAccessibleWrap.cpp,v <-- nsAccessibleWrap.cpp new revision: 1.31; previous revision: 1.30 done
Status: NEW → RESOLVED
Closed: 19 years ago
Resolution: --- → FIXED
Attachment #219260 - Flags: approval-branch-1.8.1?(aaronleventhal)
Attachment #219260 - Flags: approval-branch-1.8.1?(aaronleventhal) → approval-branch-1.8.1+
Checking in nsAccessibleWrap.cpp; /cvsroot/mozilla/accessible/src/atk/nsAccessibleWrap.cpp,v <-- nsAccessibleWrap.cpp new revision: 1.25.4.3; previous revision: 1.25.4.2 done
Keywords: fixed1.8.1
*** Bug 345088 has been marked as a duplicate of this bug. ***
See Also: → https://launchpad.net/bugs/53372
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: