320358 - Firefox crashes in nsXULButtonAccessible::GetState

Status: RESOLVED FIXED

(Firefox :: Disability Access, defect)

Description

[Ginn Chen]

1)open gnopernicus with brl-monitor
2)open firefox
3)menu->edit->prefs
4)click "connection settings..."
5)click ok to close dialogs
6)firefox crashes (not everytime, repeat 3)-5), it's quite easy to reproduce)

Stacks:

0xb16d73bd in nsXULButtonAccessible::GetState (this=0x8aafa50,
    aState=0xbfcfc694) at nsXULFormControlAccessible.cpp:150
150       element->GetAttribute(NS_LITERAL_STRING("type"), type);
(gdb) bt
#0  0xb16d73bd in nsXULButtonAccessible::GetState (this=0x8aafa50,
    aState=0xbfcfc694) at nsXULFormControlAccessible.cpp:150
#1  0xb16876ad in nsAccessible::GetFinalState (this=0x8aafa50,
    aState=0xbfcfc694) at nsAccessible.cpp:1830
#2  0xb16af5c3 in refStateSetCB (aAtkObj=0x88999a0) at nsAccessibleWrap.cpp:892
#3  0xb7a890ac in atk_object_ref_state_set () from /usr/lib/libatk-1.0.so.0
#4  0xb1634f1b in _ORBIT_skel_small_Accessibility_DeviceEventController_unImplemented4 () from /usr/lib/libspi.so.0
#5  0xb16320bf in _ORBIT_skel_small_Accessibility_Accessible_getState ()
   from /usr/lib/libspi.so.0
#6  0xb6547260 in ORBit_POA_setup_root () from /usr/lib/libORBit-2.so.0
#7  0xb654bc4e in ORBit_OAObject_invoke () from /usr/lib/libORBit-2.so.0
#8  0xb6538ceb in ORBit_small_invoke_adaptor () from /usr/lib/libORBit-2.so.0
#9  0xb654757c in ORBit_POAObject_post_invoke () from /usr/lib/libORBit-2.so.0
#10 0xb6547c1b in ORBit_POAObject_post_invoke () from /usr/lib/libORBit-2.so.0
#11 0xb654a641 in ORBit_c_stub_invoke () from /usr/lib/libORBit-2.so.0
#12 0xb654bba3 in ORBit_handle_request () from /usr/lib/libORBit-2.so.0
#13 0xb6535d10 in giop_connection_handle_input () from /usr/lib/libORBit-2.so.0
#14 0xb655224d in link_connection_set_max_buffer ()
   from /usr/lib/libORBit-2.so.0
#15 0xb6553e23 in link_servers_move_io_T () from /usr/lib/libORBit-2.so.0
#16 0xb77aadc1 in IA__g_main_context_dispatch (context=0x80773e0)
    at gmain.c:1913
#17 0xb77ae007 in g_main_context_iterate (context=0x80773e0, block=1,
    dispatch=1, self=0x81055f0) at gmain.c:2544
#18 0xb77ae558 in IA__g_main_loop_run (loop=0x8476798) at gmain.c:2748
#19 0xb7bb6e65 in gtk_main () from /usr/lib/libgtk-x11-2.0.so.0
#20 0xb613eb86 in nsAppShell::Run (this=0x8095428) at nsAppShell.cpp:139
#21 0xb608477f in nsAppStartup::Run (this=0x80953e0) at nsAppStartup.cpp:161
#22 0xb7fca0ed in XRE_main (argc=1, argv=0xbfcfce84, aAppData=0x80497e0)
    at nsAppRunner.cpp:2298
#23 0x08048646 in main (argc=1, argv=0xbfcfce84) at nsBrowserApp.cpp:61

Comment 1

[Ginn Chen]

Attachment: patch

Bug 257099 tried to fix it, but it's not complete, wrong } place.

Comment 2

[Ginn Chen]

Checking in nsXULFormControlAccessible.cpp;
/cvsroot/mozilla/accessible/src/xul/nsXULFormControlAccessible.cpp,v  <--  nsXULFormControlAccessible.cpp
new revision: 1.54; previous revision: 1.53
done

Comment 3

[Ginn Chen]

Comment on attachment 205943 [details] [diff] [review]
patch

causes crash.
This patch is no risk.

Comment 4

[Ginn Chen]

Checking in accessible/src/xul/nsXULFormControlAccessible.cpp;
/cvsroot/mozilla/accessible/src/xul/nsXULFormControlAccessible.cpp,v  <--  nsXULFormControlAccessible.cpp
new revision: 1.52.2.2; previous revision: 1.52.2.1
done