359845 - Crash [@ nsXULTreeitemAccessibleWrap::GetRole] probably !mColumn

Status: VERIFIED FIXED

(Core :: Disability Access APIs, defect)

Description

[timeless]

Incident ID: 25372706
Stack Signature	nsXULTreeitemAccessibleWrap::GetRole 705e62f1
Product ID	SunbirdTrunk
Build ID	2006100618
Trigger Time	2006-11-01 15:10:00.0
Platform	Win32
Operating System	Windows NT 5.1 build 2600
Module	sunbird.exe + (0041459f)
URL visited	
User Comments	
Since Last Crash	1077 sec
Total Uptime	22566 sec
Trigger Reason	Access violation
Source File, Line No.	d:\builds\tinderbox\sunbird-trunk\winnt_5.2_depend\mozilla\accessible\src\msaa\nsxultreeaccessiblewrap.cpp, line 88
Stack Trace 	
nsXULTreeitemAccessibleWrap::GetRole  [mozilla\accessible\src\msaa\nsxultreeaccessiblewrap.cpp, line 88]
nsAccessibleWrap::MustPrune  [mozilla\accessible\src\msaa\nsaccessiblewrap.h, line 199]
nsAccessibleWrap::get_accChildCount  [mozilla\accessible\src\msaa\nsaccessiblewrap.cpp, line 231]
jhook.dll + 0x4ccf (0x15004ccf)
jhook.dll + 0x48af (0x150048af)
jhook.dll + 0xc177 (0x1500c177)
jhook.dll + 0x70a7 (0x150070a7)
USER32.dll + 0x4902c (0x77d8902c)
ntdll.dll + 0xeae3 (0x7c90eae3)
nsAccessible::FireToolkitEvent  [mozilla\accessible\src\base\nsaccessible.cpp, line 1763]
nsRootAccessible::HandleEventWithTarget  [mozilla\accessible\src\base\nsrootaccessible.cpp, line 783]
nsSprocketLayout::PopulateBoxSizes  [mozilla\layout\xul\base\src\nssprocketlayout.cpp, line 875]
0x50010000
0x300202a7

this is a sunbird topcrash ;-)

Comment 1

[Martijn Wargers (dead)]

Attachment: testcase for branch builds

This is a testcase that crashes Mozilla with this stacktrace when clicking on the up arrow of the scrollbar.
You need to download it to your computer, because of the use of enhanced privileges.
It also seems to crash branch builds.

Comment 2

[Martijn Wargers (dead)]

Attachment: testcase

Aaron changed something in bug 268935 that makes the original testcase not work
anymore in current trunk builds.
This is the updated testcase, using nsIAccessibleRetrieval.

Comment 3

[Mats Palmgren (inactive)]

WFM, trunk and 1.8 branch builds on Linux.

Comment 4

[Olli Pettay [:smaug][[e-mail]]]

According to talkback, there are still crashes @ nsXULTreeitemAccessibleWrap::GetRole

Comment 5

[Ginn Chen]

It can crash on Linux at
nsXULTreeitemAccessible::GetAccessibleRelated
968         if (NS_SUCCEEDED(mColumn->GetIndex(&columnIndex)) && columnIndex == 0) {

Comment 6

[alexander :surkov (:asurkov)]

Attachment: patch

do not create accessibles for such trees though treeitems are visible but their text doesn't rendered. I think nobody will use these trees so we can skip their support in ally.

Comment 7

[alexander :surkov (:asurkov)]

checked in

Comment 8

[Martijn Wargers (dead)]

Thanks, verified fixed, using:
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a8pre) Gecko/2007091904 Minefield/3.0a8pre

Should the patch be considered for branch, since this was/is a topcrasher?

Comment 9

[alexander :surkov (:asurkov)]

(In reply to comment #8)

> Should the patch be considered for branch, since this was/is a topcrasher?
> 

I can't reproduce on latest seamonkey 1.8 your testcase for branch builds though problem can exists.

Comment 10

[Daniel Veditz [:dveditz]]

Comment on attachment 280998 [details] [diff] [review]
patch

This crash does not currently show up in the topcrash list for FF2, we're a bit nervous approving unnecessary changes if we're not fixing a demonstrable problem.

If you think this decision is wrong you can renominate with an explanation of the benefit-risk tradeoff.