380482 - Crash [@ nsDocAccessible::FlushEventsCallback] with quote and removing stuff

Status: RESOLVED FIXED

(Core :: Disability Access APIs, defect)

Description

[Martijn Wargers (dead)]

Attachment: testcase

See testcase, which crashes current trunk builds within 500ms.
The testcase uses enhanced privileges, so you need to download it to your desktop.

Doesn't crash in a 2007-05-09 build, does crash in a 2007-05-10 build, probably a regression from bug 377728.

Talkback ID: TB32058571M
nsCOMPtr_base::~nsCOMPtr_base  [mozilla/xpcom/build/nscomptr.cpp, line 81]
nsDocAccessible::FlushEventsCallback  [mozilla/accessible/src/base/nsdocaccessible.cpp, line 1300]
NS_ProcessNextEvent_P  [mozilla/xpcom/build/nsthreadutils.cpp, line 227]
nsBaseAppShell::Run  [mozilla/widget/src/xpwidgets/nsbaseappshell.cpp, line 154]
MSVCR80.dll + 0x8ac9 (0x78138ac9)

Marking security sensitive, because the code in the testcase should perhaps stay secret.

Comment 1

[alexander :surkov (:asurkov)]

I tried today's trunk where patch from bug 380412 is applied. I couldn't see a crash. I rolled back that patch and I get a crash. Martijn, can you confirm this bug is fixed?

Comment 2

[Martijn Wargers (dead)]

Yeah, fixed indeed by the patch from bug 380412.

Comment 3

[Daniel Veditz [:dveditz]]

What is secret about the testcase code? It's just walking the accessible tree, which is inaccessible from web content unless you've already granted it "hack me" level privileges.

Comment 4

[Martijn Wargers (dead)]

I have no problem with opening it up. It's Mats' script. Maybe he has a different opinion.

Comment 5

[Mats Palmgren (inactive)]

I don't see a problem with opening it either, so doing that...