350381 - Crash [@ nsAccessible::FireToolkitEvent] with testcase on Firefox w/ a11y or Windows XP Tablet edition

Status: RESOLVED FIXED

(Core :: Disability Access APIs, defect)

Description

[Martijn Wargers (dead)]

See discussion at:
http://forums.mozillazine.org/viewtopic.php?t=452479&highlight=
The reporter is crashing when switching tabs multiple times at the url testcase.

I can't reproduce this, but if I understand correctly, you need to have installed some kind of accessibility software to get the crash.
So maybe it is for those people reproducable?

Talkback ID: 22313851H
Stack Signature	 0x02b80007 8f967d72
Product ID	Firefox15
Build ID	2006072814
Trigger Time	2006-08-20 18:40:13.0
Platform	Win32
Operating System	Windows NT 5.1 build 2600
Module	
URL visited	http://71.121.130.228/testCrash.htm
User Comments	click back and forth between the tab links. After half a dozen or so, firefox crashes
Since Last Crash	109 sec
Total Uptime	109 sec
Trigger Reason	Access violation
Source File, Line No.	N/A
Stack Trace 	
0x02b80007
nsAccessible::FireToolkitEvent  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/accessible/src/base/nsAccessible.cpp, line 1672]
nsHTMLLinkAccessible::FireToolkitEvent  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/accessible/src/html/nsHTMLLinkAccessible.cpp, line 104]
nsRootAccessible::FireAccessibleFocusEvent  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/accessible/src/base/nsRootAccessible.cpp, line 477]
nsRootAccessible::HandleEvent  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/accessible/src/base/nsRootAccessible.cpp, line 741]
nsRootAccessible::Focus  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/accessible/src/base/nsRootAccessible.cpp, line 940]
nsEventListenerManager::HandleEvent  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/content/events/src/nsEventListenerManager.cpp, line 1781]
nsXULDocument::HandleDOMEvent  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/content/xul/document/src/nsXULDocument.cpp, line 1236]
nsXULElement::HandleDOMEvent  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/content/xul/content/src/nsXULElement.cpp, line 2125]
nsXULElement::HandleDOMEvent  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/content/xul/content/src/nsXULElement.cpp, line 2122]
nsXULElement::HandleDOMEvent  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/content/xul/content/src/nsXULElement.cpp, line 2122]
nsXULElement::HandleDOMEvent  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/content/xul/content/src/nsXULElement.cpp, line 2122]
nsXULElement::HandleDOMEvent  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/content/xul/content/src/nsXULElement.cpp, line 2122]
nsXULElement::HandleDOMEvent  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/content/xul/content/src/nsXULElement.cpp, line 2122]
nsXULElement::HandleDOMEvent  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/content/xul/content/src/nsXULElement.cpp, line 2122]
nsXULElement::HandleDOMEvent  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/content/xul/content/src/nsXULElement.cpp, line 2122]
nsXULElement::HandleChromeEvent  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/content/xul/content/src/nsXULElement.cpp, line 2823]
nsGlobalWindow::HandleDOMEvent  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/dom/src/base/nsGlobalWindow.cpp, line 1583]
nsDocument::HandleDOMEvent  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/content/base/src/nsDocument.cpp, line 4002]
nsGenericElement::HandleDOMEvent  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/content/base/src/nsGenericElement.cpp, line 2139]
nsGenericElement::HandleDOMEvent  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/content/base/src/nsGenericElement.cpp, line 2133]
nsGenericElement::HandleDOMEvent  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/content/base/src/nsGenericElement.cpp, line 2133]
nsHTMLFormElement::HandleDOMEvent  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/content/html/content/src/nsHTMLFormElement.cpp, line 708]
nsGenericElement::HandleDOMEvent  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/content/base/src/nsGenericElement.cpp, line 2133]
nsGenericElement::HandleDOMEvent  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/content/base/src/nsGenericElement.cpp, line 2133]
nsGenericElement::HandleDOMEvent  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/content/base/src/nsGenericElement.cpp, line 2133]
nsGenericElement::HandleDOMEvent  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/content/base/src/nsGenericElement.cpp, line 2133]
nsGenericHTMLElement::HandleDOMEventForAnchors  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/content/html/content/src/nsGenericHTMLElement.cpp, line 1491]
nsHTMLAreaElement::HandleDOMEvent  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/content/html/content/src/nsHTMLAreaElement.cpp, line 180]
nsEventStateManager::SendFocusBlur  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/content/events/src/nsEventStateManager.cpp, line 4311]
nsEventStateManager::SetContentState  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/content/events/src/nsEventStateManager.cpp, line 3948]
nsGenericHTMLElement::HandleDOMEventForAnchors  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/content/html/content/src/nsGenericHTMLElement.cpp, line 1573]
nsHTMLAreaElement::HandleDOMEvent  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/content/html/content/src/nsHTMLAreaElement.cpp, line 180]
PresShell::HandleEventInternal  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/base/nsPresShell.cpp, line 6379]
PresShell::HandleEvent  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/base/nsPresShell.cpp, line 6215]
nsViewManager::HandleEvent  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/view/src/nsViewManager.cpp, line 2559]
nsViewManager::DispatchEvent  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/view/src/nsViewManager.cpp, line 2246]
HandleEvent  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/view/src/nsView.cpp, line 174]
nsWindow::DispatchEvent  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/widget/src/windows/nsWindow.cpp, line 1258]
nsWindow::DispatchMouseEvent  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/widget/src/windows/nsWindow.cpp, line 6028]
ChildWindow::DispatchMouseEvent  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/widget/src/windows/nsWindow.cpp, line 6279]
nsWindow::WindowProc  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/widget/src/windows/nsWindow.cpp, line 1440]
USER32.dll + 0x8734 (0x77d48734)
USER32.dll + 0x8816 (0x77d48816)
USER32.dll + 0x89cd (0x77d489cd)
USER32.dll + 0x8a10 (0x77d48a10)
nsAppShell::Run  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/widget/src/windows/nsAppShell.cpp, line 159]
nsAppStartup::Run  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/toolkit/components/startup/src/nsAppStartup.cpp, line 151]
main  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/browser/app/nsBrowserApp.cpp, line 61]
kernel32.dll + 0x16fd7 (0x7c816fd7)

Comment 1

[Martijn Wargers (dead)]

Attachment: testcase, zipped

Attaching testcase to bug, in case the url disappears.

Comment 2

[Martijn Wargers (dead)]

Attachment: testcase

Ok, with a demo version of Window-Eyes installed, I can reproduce the crash.
I managed to minimize it to this.
Three times clicking on the link is often enough. If it doesn't crash then, try again with reloading.

Talkback ID: TB23568514W

Comment 3

[Martijn Wargers (dead)]

I can also reproduce the crash with current trunk build.

Comment 4

[Aaron Leventhal]

I have a fix that involves removing the caching of mFrame on nsHTMLLinkAccessible.h, but I want to see why that caching isn't working.

Comment 5

[Aaron Leventhal]

For me, 1 more link click is necessary to get the crash for the most recent testcase.

Comment 6

[Aaron Leventhal]

Our hook for discovering frames made visible is not working in nsCSSFrameConstructor::RestyleElement()

I see it still works in my older testcase where we set the display style directly via elt.style.display = (elt.style.display == 'none') ? 'inline' : 'none';

However, in this case the style change is by changing the class on the parent <div>. In the hiding case this works, but when the element was hidden and is becoming shown, the frame is already created when we hit RestyleElement().

Our cache invalidation isn't working because this hook isn't working. We can wall paper around the problem but we still need a real fix.

Comment 7

[Aaron Leventhal]

RestyleElement() only knows that the <div> is being changed, not about the children being changed, unless we look at the change list.

The actual inline frame is being created via RecreateFramesFor()

We need to do something to catch when the restyle is causing a new frame to be created or the frame type to change, no matter how it happens.

Comment 8

[Aaron Leventhal]

Filed bug 354745 on the root cause of this bug.