Crash exposing dynamically changing <option> lists

VERIFIED FIXED

Status

()

Core
Disability Access APIs
VERIFIED FIXED
12 years ago
12 years ago

People

(Reporter: Aaron Leventhal, Assigned: Aaron Leventhal)

Tracking

({access, fixed1.8})

Trunk
x86
All
access, fixed1.8
Points:
---

Firefox Tracking Flags

(Not tracked)

Details

(URL)

Attachments

(1 attachment)

(Assignee)

Description

12 years ago
We're not setting the end of the list correctly when we cache a group of <option>'s.

As a result, options lists can crash when you get next sibling.

Steps to repro:
1. Launch Window-Eyes
2. Go to http://www.creative.com/language.asp
3. Type Ctrl+Shift+A to turn off browse mode
4. Click on the first list
5. Down arrow

Firefox will crash
(Assignee)

Comment 1

12 years ago
Created attachment 199894 [details] [diff] [review]
SetNextSibling(nsnull) on the last <option> cached
Attachment #199894 - Flags: superreview?(bzbarsky)
Attachment #199894 - Flags: review?(bzbarsky)

Comment 2

12 years ago
Comment on attachment 199894 [details] [diff] [review]
SetNextSibling(nsnull) on the last <option> cached

sr=bzbarsky, but I have to confess I have no idea what this code is doing (and
no time to sort it out).
Attachment #199894 - Flags: superreview?(bzbarsky)
Attachment #199894 - Flags: superreview+
Attachment #199894 - Flags: review?(bzbarsky)
(Assignee)

Updated

12 years ago
Attachment #199894 - Flags: review?(parente)

Comment 3

12 years ago
Comment on attachment 199894 [details] [diff] [review]
SetNextSibling(nsnull) on the last <option> cached

Do you need to check if the QI succeeds on lastGoodAccessible before using it?
Attachment #199894 - Flags: review?(parente) → review+
(Assignee)

Comment 4

12 years ago
(In reply to comment #3)
> (From update of attachment 199894 [details] [diff] [review] [edit])
> Do you need to check if the QI succeeds on lastGoodAccessible before using it?

No, it will always succeed. We put assertions in sometimes but it will never get
hit.
(Assignee)

Updated

12 years ago
Attachment #199894 - Flags: approval1.8rc1?
(Assignee)

Updated

12 years ago
Status: NEW → RESOLVED
Last Resolved: 12 years ago
Resolution: --- → FIXED
(Assignee)

Comment 5

12 years ago
This has been tested by GW Micro in a special build created for them.

Comment 6

12 years ago
Verified that this has been fixed in dev build 10/18/05 build from aaron.
(Assignee)

Comment 7

12 years ago
Verified by Doug Geoffray from GW Micro.
Status: RESOLVED → VERIFIED

Updated

12 years ago
Attachment #199894 - Flags: approval1.8rc1? → approval1.8rc1+
(Assignee)

Updated

12 years ago
Keywords: fixed1.8
You need to log in before you can comment on or make changes to this bug.