368950 - atk_object_notify_state_change triggers gobject critical warning when accessibility is turned on

Status: RESOLVED FIXED

(Firefox :: Disability Access, defect)

Description

[Tim Miao]

Attachment: stacktrace

Downloaded the firefox trunk nightly build 20070201, firefox crashes while starting.

This bug is only visible on solaris, it's not reproducible on linux. Add the stack trace below.

Comment 1

[Tim Miao]

Attachment: stacktrace

Comment 2

[timeless]

 d26e0ec4 abort    (0, cf693730, d1a91e0c, cbd46f10, d24edc1f, 3) + 64
 d1a2b1b4 g_logv   (d19c34a8, 8, d19c3480, 8043c28) + 340
 d1a2b1dd g_log    (d19c34a8, 8, d19c3480, d19c3394, 84e, d19c3258) + 25
 d19b1148 g_signal_emit_valist (0, 9c, 109, 8043ebc) + a2c
 d19b1175 g_signal_emit (0, 9c, 109, cf693730, 1, 0) + 25
 cf68b197 atk_object_notify_state_change (0, 1c, 0, 1) + 3f
 cbc88dd3 unsigned nsDocAccessibleWrap::FireToolkitEvent(unsigned,nsIAccessible*,void*) (8ad7418, 8002, 8c3f128, 0) + 1af3
 cbbda90d unsigned nsDocAccessible::FlushPendingEvents() (8ad7418) + 39d
 cbbdaa78 void nsDocAccessible::FlushEventsCallback(nsITimer*,void*) (8aebb60, 8ad7470) + 68
 d24d9b63 void nsTimerImpl::Fire() (8aebb60) + 2a3
 d24d9d90 unsigned nsTimerEvent::Run() (8a86188) + 100
 d24cfd8e unsigned nsThread::ProcessNextEvent(int,int*) (8084418, 1, 8044374) + 26e
 d241f63f int NS_ProcessNextEvent_P(nsIThread*,int) (8084418, 1) + 7f
 cc11ef05 unsigned nsXULWindow::ShowModal() (8c72208) + 1f5
 cc1139bf unsigned nsContentTreeOwner::ShowAsModal() (8c7ab60) + 3f
 cc57c8d0 unsigned nsWindowWatcher::OpenWindowJSInternal(nsIDOMWindow*,const char*,const char*,const char*,int,nsIArray*,int,nsIDOMWindow**) (8496730, 87e9240, cc62f134, cc5e7b16, cc5e7b1d, 1) + 2bd0
 cc579af2 unsigned nsWindowWatcher::OpenWindow(nsIDOMWindow*,const char*,const char*,const char*,nsISupports*,nsIDOMWindow**) (8496730, 87e9240, cc62f134, cc5e7b16, cc5e7b1d, 8c712f8) + 5c2
 cc59261a unsigned nsPromptService::DoDialog(nsIDOMWindow*,nsIDialogParamBlock*,const char*) (83a3130, 87e9240, 8c712f8, cc62f134) + 1ea
 cc5900fb unsigned nsPromptService::ConfirmEx(nsIDOMWindow*,const unsigned short*,const unsigned short*,unsigned,const unsigned short*,const unsigned short*,const unsigned short*,const unsigned short*,int*,int*) (83a3130, 87e9240, 8c6ce58, 8c64808, 0, 0) + 82b
 d24f90b8 NS_InvokeByIndex (83a3130, 7, a, 8c71250) + 51

Comment 3

[Evan Yan]

It's in fact a critical warning, but not crash. It crashes just because we're on gnome 2.17 with $G_DEBUG=fatal_criticals.

With the environment G_DEBUG cleared, firefox won't crash and can see below critical warning on terminal.

(Gecko:873): GLib-GObject-CRITICAL **: file gsignal.c: line 2126: assertion `G_TYPE_CHECK_INSTANCE (instance)' failed

Changing subjust and OS.
And I didn't find any dupe of this bug, also clearing whiteboard DUPEME.

Comment 4

[Evan Yan]

Attachment: patch

do nothing when GetAtkObject() returns null. GetAtkObject() will return null when !IsEmbeddedObject()

Comment 5

[Aaron Leventhal]

Comment on attachment 257490 [details] [diff] [review]
patch

Very nice -- it also reduces code size. One important thing though, what are firing events on that is not an embedded object? We should be concerned that important events might be thrown away.

Comment 6

[Evan Yan]

when inputing the first character or deleting the last character in a textfield, EVENT_SHOW will be fired for the text.

Is that a bug?

Comment 7

[Aaron Leventhal]

No, it's not a bug. But it would probably be bug if a text object got any event other than SHOW or HIDE.

Comment 8

[Evan Yan]

I added an assertion about that no event other than SHOW and HIDE is fired for plain text leaves into the landed patch.