Closed Bug 322453 Opened 19 years ago Closed 18 years ago

crash if I use Midas in htmlarea when editing list box [@ nsAccessible::GetNextSibling]

Categories

(Core :: Disability Access APIs, defect)

Product:
Core
Component:
Disability Access APIs
Version:
1.8 Branch
Platform:
x86
Linux
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED WORKSFORME

People

(Reporter: mara, Assigned: evan.yan)

References

(
URL
)

Details

(Keywords: crash)

Crash Data

User-Agent:       Mozilla/5.0 (X11; U; Linux i686; cs; rv:1.8) Gecko/20051111 Firefox/1.5
Build Identifier: Mozilla/5.0 (X11; U; Linux i686; cs; rv:1.8) Gecko/20051111 Firefox/1.5

When I create list and write first item and press Enter and write seccond item and press Enter and press Enter again browser crashed.

Firefox 1.0.7 in Linux is ok, Firefox 1.5 in Windows XP is ok, but Firefox 1.5 in Linux crashed.

I mean, that this problem is not in htmlarea. I try some others editors and Firefox always crashed.

Reproducible: Always

Steps to Reproduce:
1. create list
2. write first item and press Enter
3. write seccond item and press Enter
4. press Enter
Actual Results:  
Firefox 1.5 in Linux crashed.


Firefox 1.5 in Windows XP not crashed.
Do you get a Talkback ID? Could you give a Talkback ID?
Assignee: nobody → mozeditor
Component: General → Editor
Product: Firefox → Core
QA Contact: general
Version: unspecified → 1.8 Branch
(In reply to comment #1)
> Do you get a Talkback ID? Could you give a Talkback ID?
> 

TB13334694E
TB13596030E
TB13601412K

From one of the Talkback ID's:
firefox-bin + 0x93823a (0x0898023a)
nsAccessible::Shutdown()  [/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/accessible/src/base/nsAccessible.cpp, line 848]
nsHTMLLIAccessible::Shutdown()
nsDocAccessible::RefreshNodes()  [/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/accessible/src/base/nsDocAccessible.cpp, line 85]
nsDocAccessible::InvalidateCacheSubtree()  [/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/accessible/src/base/nsDocAccessible.cpp, line 842]
nsDocAccessible::ContentRemoved()  [/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/accessible/src/base/nsDocAccessible.cpp, line 904]
nsDocument::ContentRemoved()  [/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/content/base/src/nsDocument.cpp, line 2397]
doRemoveChildAt()  [/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/content/base/src/nsGenericElement.cpp, line 2962]
nsGenericElement::RemoveChildAt()  [/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/content/base/src/nsGenericElement.cpp, line 842]
nsGenericElement::RemoveChild()  [/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/content/base/src/nsGenericElement.cpp, line 3720]
DeleteElementTxn::DoTransaction()  [/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/editor/libeditor/base/DeleteElementTxn.cpp, line 848]
nsTransactionItem::DoTransaction()  [/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/editor/txmgr/src/nsTransactionItem.cpp, line 180]
nsTransactionManager::BeginTransaction()  [/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/editor/txmgr/src/nsTransactionManager.cpp, line 1071]
nsTransactionManager::DoTransaction()  [/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/editor/txmgr/src/nsTransactionManager.cpp, line 132]
nsEditor::DoTransaction()  [/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/editor/libeditor/base/nsEditor.cpp, line 848]
nsEditor::DeleteNode()  [/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/editor/libeditor/base/nsEditor.cpp, line 1526]
nsHTMLEditor::DeleteNode()  [/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/editor/libeditor/html/nsHTMLEditor.cpp, line 842]
nsHTMLEditRules::ReturnInListItem()  [/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/editor/libeditor/html/nsHTMLEditRules.cpp, line 6493]
nsHTMLEditRules::WillInsertBreak()  [/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/editor/libeditor/html/nsHTMLEditRules.cpp, line 1581]
nsPlaintextEditor::InsertLineBreak()  [/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/editor/libeditor/text/nsPlaintextEditor.cpp, line 820]
nsPlaintextEditor::TypedText()  [/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/editor/libeditor/text/nsPlaintextEditor.cpp, line 830]
nsHTMLEditor::TypedText()  [/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/editor/libeditor/html/nsHTMLEditor.cpp, line 830]
nsHTMLEditor::HandleKeyPress()  [/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/editor/libeditor/html/nsHTMLEditor.cpp, line 1334]
nsTextEditorKeyListener::KeyPress()  [/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/editor/libeditor/text/nsEditorEventListeners.cpp, line 243]
DispatchToInterface(nsIDOMEvent*, nsIDOMEventListener*, unsigned (nsIDOMEventListener::*)()  [/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/content/events/src/nsEventListenerManager.cpp, line 141]
nsEventListenerManager::HandleEvent()  [/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/content/events/src/nsEventListenerManager.cpp, line 1777]
nsDocument::HandleDOMEvent()  [/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/content/base/src/nsDocument.cpp, line 4003]
nsGenericElement::HandleDOMEvent()  [/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/content/base/src/nsGenericElement.cpp, line 2204]
PresShell::HandleEventInternal()  [/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/layout/base/nsPresShell.cpp, line 848]
PresShell::HandleEvent()  [/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/layout/base/nsPresShell.cpp, line 6202]
nsViewManager::HandleEvent()  [/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/view/src/nsViewManager.cpp, line 848]
nsViewManager::DispatchEvent()  [/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/view/src/nsViewManager.cpp, line 2246]
HandleEvent()  [/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/view/src/nsView.cpp, line 251]
nsCommonWidget::DispatchEvent()  [/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/widget/src/gtk2/nsCommonWidget.cpp, line 219]
nsWindow::OnKeyPressEvent()  [/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/widget/src/gtk2/nsWindow.cpp, line 1779]
key_press_event_cb()  [/builds/tinderbox/Fx-Mozilla1.8/Linux_2.4.21-27.0.4.ELsmp_Depend/mozilla/widget/src/gtk2/nsWindow.cpp, line 3862]

So you're somehow crashing in accessibility code.
Keywords: crash
Summary: crash if I use Midas in htmlarea when I edning list box → crash if I use Midas in htmlarea when editing list box [@ nsAccessible::GetNextSibling]
> So you're somehow crashing in accessibility code.
> 

This bug only on my GNU/Linux configuration? Other GNU/Linux is ok? Can you this bug CONFIRMED and changed Status from UNCONFIRMED?
I can't confirm the bug, unless I have a testcase that reproduces the crash.
worksforme with linux seamonkey trunk 2006010501 and 1.8 branch build 2006010200
Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9a1) Gecko/20060105 Firefox/1.6a1

Works for me in 1.5 and in trunk. Marek, can you reproduce this in a clean profile? http://kb.mozillazine.org/Profile_Manager
(In reply to comment #7)
> Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9a1) Gecko/20060105 Firefox/1.6a1
> 
> Works for me in 1.5 and in trunk. Marek, can you reproduce this in a clean
> profile? http://kb.mozillazine.org/Profile_Manager
> 

A. $ ./firefox -profilemanager
B. create new profile Test
C. Steps 1. - 4. from "Steps to Reproduce"
D. my Firefox crashed:-(


Console:
$ ./firefox -profilemanager

(Gecko:1955): GLib-GObject-WARNING **: gsignal.c:2316: signal name `text_caret_moved' is invalid for instance `0x92c2dd0'
./run-mozilla.sh: line 424:  1955 Segmentation fault      "$prog" ${1+"$@"}


Talkback ID:
TB13730756X

Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9a1) Gecko/20060219 Firefox/1.6a1 ID:2006021908
Works for me.
Reporter, do you have any GNOME accessibility aids/assistive technologies turned on?
(In reply to comment #10)
> Reporter, do you have any GNOME accessibility aids/assistive technologies
> turned on?
> 

Wow! Yes - this is the problem. When I turned off GNOME accessibility firefox works ok.
Related to (possible dupe) of bug #323450.
Tim Miao, can you duplicate this? None of the talkback reports will open for me.
Assignee: mozeditor → ginn.chen
Blocks: fox2access
Component: Editor → Disability Access APIs
Didn't crash Firefox, but

1) GOK crashed 
2) I do get a lot of these messages:
(Gecko:7013): GLib-GObject-WARNING **: gsignal.c:2316: signal name `text_caret_moved' is invalid for instance `0x9ac2878'
3)I couldn't walk into the editor content using at-poke

We should revisit this after we reengineer the ATK support for documents.
No longer blocks: fox2access
confirmed

#0  0x00000000 in ?? ()
#1  0xb126baf9 in ns_if_addref<nsIAccessible*> (expr=0x8c7843c)
    at nsISupportsUtils.h:114
#2  0xb126f8dd in nsAccessible::GetNextSibling (this=0x8be1600,
    aNextSibling=0xbff1944c) at nsAccessible.cpp:468
#3  0xb127073f in nsAccessible::Shutdown (this=0x8b88d00)
    at nsAccessible.cpp:398
#4  0xb1293e0c in nsHTMLLIAccessible::Shutdown (this=0x8b88d00)
    at nsHTMLTextAccessible.h:126
#5  0xb125c510 in nsDocAccessible::RefreshNodes (this=0x8b94728,
    aStartNode=0x8a9e1ac, aChangeEvent=32771) at nsDocAccessible.cpp:1025
#6  0xb125e9ad in nsDocAccessible::InvalidateCacheSubtree (this=0x8b94728,
    aChild=0x8a9e190, aChangeEventType=32771) at nsDocAccessible.cpp:1095
#7  0xb125aecc in nsDocAccessible::ContentRemoved (this=0x8b94728,
    aDocument=0x8bb46c8, aContainer=0x8ba97b0, aChild=0x8a9e190,
    aIndexInContainer=2) at nsDocAccessible.cpp:897
#8  0xb4fed6f4 in nsDocument::ContentRemoved (this=0x8bb46c8,
    aContainer=0x8ba97b0, aChild=0x8a9e190, aIndexInContainer=2)
    at nsDocument.cpp:2415
Status: UNCONFIRMED → NEW
Ever confirmed: true
Blocks: fox2access
Blocks: newatk
No longer blocks: fox2access
This is WORKSFORME on 7/18/06 trunk.
Status: NEW → RESOLVED
Closed: 18 years ago
Resolution: --- → WORKSFORME
It's reproducible for MOZILLA_1_8_BRANCH.
I think we should not crash Firefox 2.0 / Thunderbird 2.0.
Reopened.
Blocks: fox2access
No longer blocks: newatk
Status: RESOLVED → REOPENED
Resolution: WORKSFORME → ---
Assignee: ginn.chen → Evan.Yan
Status: REOPENED → NEW
It's WORKSFORME on lastest MOZILLA_1_8_BRANCH build.

I tested on both of Linux and Solaris with GNOME_ACCESSIBILITY open.
Status: NEW → RESOLVED
Closed: 18 years ago → 18 years ago
Resolution: --- → WORKSFORME
Crash Signature: [@ nsAccessible::GetNextSibling]
You need to log in before you can comment on or make changes to this bug.