320914 - Firefox crashed with gnopernicus magnifier [@ nsXULMenuitemAccessible::GetState]

Status: RESOLVED FIXED

(Firefox :: Disability Access, defect)

Description

[Ginn Chen]

I started Firefox and gnopernicus with magnifier, and then quit firefox.
Firefox crashed, gnopernicus also crashed.

Here's the message.
###!!! ASSERTION: No nsIDOMElement for button node!: 'element', file nsXULFormControlAccessible.cpp, line 141
Break: at file nsXULFormControlAccessible.cpp, line 141
WARNING: NS_ENSURE_TRUE(NS_SUCCEEDED(CheckMaiAtkObject(aAtkObj))) failed, file nsAccessibleWrap.cpp, line 774
###!!! ASSERTION: No DOM element for menu  node!: 'element', file nsXULMenuAccessible.cpp, line 65
Break: at file nsXULMenuAccessible.cpp, line 65
###!!! ASSERTION: You can't dereference a NULL nsCOMPtr with operator->().: 'mRa
sible.cpp, line 65
Break: at file nsXULMenuAccessible.cpp, line 65
###!!! ASSERTION: You can't dereference a NULL nsCOMPtr with operator->().: 'mRawPtr != 0', file ../../../dist/include/xpcom/nsCOMPtr.h, line 849
Break: at file ../../../dist/include/xpcom/nsCOMPtr.h, line 849

Program dist/bin/firefox-bin (pid = 928) received signal 11.
Stack:
UNKNOWN [dist/bin/libxul.so +0x0001A4D7]
__kernel_sigreturn+0x00000000 [ +0x00000420]
UNKNOWN [/home/ginn/firefox1216/mozilla/dist/bin/components/libaccessibility.so +0x0003C6AD]
UNKNOWN [/home/ginn/firefox1216/mozilla/dist/bin/components/libaccessibility.so +0x000645C3]
atk_object_ref_state_set+0x000000A9 [/usr/lib/libatk-1.0.so.0 +0x0000B0AC]
UNKNOWN [/usr/lib/libspi.so.0 +0x0002DF1B]

Stack:
#0  0xffffe410 in ?? ()
#1  0xbfb713fc in ?? ()
#2  0xb75e60dc in ?? () from /lib/tls/i686/cmov/libc.so.6
#3  0xbfb71258 in ?? ()
#4  0xb7547d46 in nanosleep () from /lib/tls/i686/cmov/libc.so.6
#5  0xb7547b4c in sleep () from /lib/tls/i686/cmov/libc.so.6
#6  0xb7f1b272 in ah_crap_handler (signum=11) at nsSigHandlers.cpp:132
#7  0xb7f314d7 in nsProfileLock::FatalSignalHandler (signo=11)
    at nsProfileLock.cpp:210
#8  <signal handler called>
#9  0xb70f8bd3 in nsXULMenuitemAccessible::GetState (this=0x889e8c0, 
    _retval=0xbfb71a44) at nsXULMenuAccessible.cpp:67
#10 0xb70a56ad in nsAccessible::GetFinalState (this=0x889e8c0, 
    aState=0xbfb71a44) at nsAccessible.cpp:1830
#11 0xb70cd5c3 in refStateSetCB (aAtkObj=0x889eeb8) at nsAccessibleWrap.cpp:892
#12 0xb7a000ac in atk_object_ref_state_set () from /usr/lib/libatk-1.0.so.0
#13 0xb3479f1b in _ORBIT_skel_small_Accessibility_DeviceEventController_unImplemented4 () from /usr/lib/libspi.so.0
#14 0xb34770bf in _ORBIT_skel_small_Accessibility_Accessible_getState ()
   from /usr/lib/libspi.so.0

Comment 1

[Ginn Chen]

Attachment: patch

similar to bug 320358

Comment 2

[Aaron Leventhal]

Comment on attachment 206366 [details] [diff] [review]
patch

We should remove the assertion, and instead of using NS_ENSURE_TRUE, we should use if ()
The reason is that it's actually fairly normal for this to happen. If a DOM node goes away inside Mozilla, but the AT asks for info on it, we hold onto the accessible, but mDOMNode is nsnull. Unfortunately NS_ENSURE_TRUE prints debugging messages in the console.

For an example see:
http://lxr.mozilla.org/seamonkey/source/accessible/src/base/nsAccessible.cpp#185

Comment 3

[Ginn Chen]

Attachment: patch addressing Aaron's comment

Comment 4

[Ginn Chen]

Checking in nsXULFormControlAccessible.cpp;
/cvsroot/mozilla/accessible/src/xul/nsXULFormControlAccessible.cpp,v  <--  nsXULFormControlAccessible.cpp
new revision: 1.55; previous revision: 1.54
done
Checking in nsXULMenuAccessible.cpp;
/cvsroot/mozilla/accessible/src/xul/nsXULMenuAccessible.cpp,v  <--  nsXULMenuAccessible.cpp
new revision: 1.38; previous revision: 1.37
done

Comment 5

[Ginn Chen]

Comment on attachment 206468 [details] [diff] [review]
patch addressing Aaron's comment

causes crash.
This patch is no risk.

See also Bug 320358

Comment 6

[Ginn Chen]

Checking in src/xul/nsXULFormControlAccessible.cpp;
/cvsroot/mozilla/accessible/src/xul/nsXULFormControlAccessible.cpp,v  <--  nsXULFormControlAccessible.cpp
new revision: 1.52.2.3; previous revision: 1.52.2.2
done
Checking in src/xul/nsXULMenuAccessible.cpp;
/cvsroot/mozilla/accessible/src/xul/nsXULMenuAccessible.cpp,v  <--  nsXULMenuAccessible.cpp
new revision: 1.36.4.2; previous revision: 1.36.4.1
done