352489 - Firefox crashed while browsing the preferences with orca [@ nsXULSelectableAccessible::RefSelection]

Status: RESOLVED FIXED

(Firefox :: Disability Access, defect)

Description

[Tim Miao]

This bug makes firefox crash.
Steps to reproduce:
1. Launch orca and firefox.
2. Open firefox Preferences->Main tab, press Tab to browse the settings in this tab.

Expected result:
User could browse the settings in current tab.

Actual result:
After pressing Tab twice, firefox core dumped.

Additional info:
This bug can be found with Mozilla/5.0 (X11; U; SunOS i86pc; en-US; rv:1.9a1) Gecko/20060911 Minefield/3.0a1 and orca1.0.0 on gnome2.14 (solaris nevada build 46). It will not be reproduced if the orca is not running.

Comment 1

[Tim Miao]

Attachment: core stack trace

Comment 2

[Ginn Chen]

In nsXULSelectableAccessible::RefSelection

accService->GetAccessibleInWeakShell(tempDOMNode, mWeakShell, getter_AddRefs(tempAccess)); fails

************************************************************
* Call to xpconnect wrapped JSObject produced this error:  *
[Exception... "'Permission denied to get property XULElement.ownerDocument' when calling method: [nsIDOMXULSelectControlItemElement::ownerDocument]"  nsresult: "0x8057001e (NS_ERROR_XPC_JS_THREW_STRING)"  location: "<unknown>"  data: no]
************************************************************

Comment 3

[Ginn Chen]

[14:38] 	bz	ginn: oh.
[14:38] 	bz	ginn: I guess that always happens...
[14:38] 	bz	ginn: if you make a call into a JS-implemented component while no JS is on the stack
[14:38] 	bz	ginn: you will end up with that component running on the safe context
[14:39] 	bz	ginn: if you know you're calling into a JS-implemented thing, you may want to push the "right" JSContext yourself
[14:39] 	ginn	how to push?
[14:40] 	biesi	why does this call JS code?
[14:40] 	bz	ginn: see http://lxr.mozilla.org/seamonkey/source/content/base/src/nsContentUtils.cpp#2394
[14:40] 	bz	ginn: for what you want to do
[14:40] 	bz	biesi: it's calling an XBL-implemented method
[14:40] 	bz	biesi: the XBL implements an accessibility interface, see
[14:41] 	bz	ginn: ideally xpconnect would do this for you automagically; if pushing the cx helps, file a bug on that and cc me, jst, shaver, mrbkap?

Yes, pushing helps.

Comment 4

[Ginn Chen]

Attachment: patch to avoid crash

Aaron, do you think we should check-in this patch to avoid crash first?
Tim could not test Firefox with Orca if it's too easy to crash.

Comment 5

[Boris Zbarsky [:bzbarsky]]

er... this bug was about an accessibility issue, right?  We should just have a separate bug on the xpconnect issue, one not confused by extraneous patches...

Comment 6

[Adam Guthrie]

Talking to Mark Pilgrim on IRC, he says that the problem is that the "new-ATK" is exposing things that it shouldn't. In this case, it's returning high-bit unicode characters when "TEXT::getText()" is called to get the input's text. 

He said that the location bar had the same issue, but now it's fixed. So maybe this isn't the right patch?

Comment 7

[Adam Guthrie]

I /think/ that this might be fixed by bug 352195, but I'm new to this stuff. (Where you're tabbing to is, after all, a autocomplete textbox).

Comment 8

[Ginn Chen]

I don't think so.

This bug talks about nsIDOMXULSelectControlItemElement, I don't think it's autocomplete.

This bug will be gone by fixing Bug 352791.
But before that, i want to avoid null pointer to make the testing smooth.

Comment 9

[Ginn Chen]

Commited, still need to fix Bug 352791 to get nsXULSelectableAccessible::RefSelection work.