350565 - crash when using at-poke log text-caret-moved event [@nsHyperTextAccessible::GetRelativeOffset]

Status: RESOLVED FIXED

(Firefox :: Disability Access, defect)

Description

[Evan Yan]

reproduce steps:
1. start firefox with accessibility enabled, locate to a webpage with textfield, say www.mozilla.org/projects/minefield;
2. start at-poke log event, check the checkbox for text-caret-moved event;
3. click on a textfield to focus;

then firefox crash. it can be always reproduced.

Comment 1

[Evan Yan]

Attachment: core dump stack

Comment 2

[Evan Yan]

startFrame was null in nsHyperTextAccessible::GetTextHelper()

Comment 3

[Aaron Leventhal]

Attachment: Null check and return early

Comment 4

[Evan Yan]

Comment on attachment 236261 [details] [diff] [review]
Null check and return early

the patch does work for me.
but I'm curious about the condition that startFrame would be null, Aaron, could you please explain it for me?

Comment 5

[Aaron Leventhal]

Evan, it is null because startOffset has been incremented past the end of the string.

FWIW I plan to change this code anyway for bug 349909.

Comment 6

[Evan Yan]

Comment on attachment 236261 [details] [diff] [review]
Null check and return early

r=me