381057 - Crash [@ nsXULTreeAccessibleWrap::GetChildCount()] with tree, key and treechildren

Status: VERIFIED FIXED

(Core :: Disability Access APIs, defect)

Description

[Martijn Wargers (dead)]

Attachment: testcase

See testcase, to see the crash you need to download the testcase to your computer, because of the use of enhanced privileges.
This is crashing with the latest nightly trunk build on Linux (Ubuntu-6.06.1).
It doesn't seem to crash on windows.

Talkback ID: 32236158Q
nsXULTreeAccessibleWrap::GetChildCount()  [mozilla/accessible/src/atk/nsXULTreeAccessibleWrap.cpp, line 72]
nsAccessible::GetFirstChild()  [mozilla/accessible/src/base/nsAccessible.cpp, line 113]
nsXULTreeAccessible::GetFirstChild()  [mozilla/accessible/src/xul/nsXULTreeAccessible.cpp, line 255]
NS_InvokeByIndex_P()
XPCWrappedNative::CallMethod(XPCCallContext&, XPCWrappedNative::CallMode)()  [mozilla/js/src/xpconnect/src/xpcwrappednative.cpp, line 2244]
XPC_WN_GetterSetter()  [mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp, line 2017]
js_Invoke()  [mozilla/js/src/jsinterp.c, line 1332]
js_InternalInvoke()  [mozilla/js/src/jsinterp.c, line 1427]
js_InternalGetOrSet()  [mozilla/js/src/jsinterp.c, line 1498]
js_NativeGet()  [mozilla/js/src/jsobj.c, line 3478]
js_GetProperty()  [mozilla/js/src/jsobj.c, line 3607]
js_Interpret()  [mozilla/js/src/jsinterp.c, line 3784]
js_Invoke()  [mozilla/js/src/jsinterp.c, line 1351]
js_InternalInvoke()  [mozilla/js/src/jsinterp.c, line 1427]
JS_CallFunctionValue()  [mozilla/js/src/jsapi.c, line 4856]
nsJSContext::CallEventHandler()  [mozilla/dom/src/base/nsJSEnvironment.cpp, line 1796]
nsGlobalWindow::RunTimeout()  [mozilla/dom/src/base/nsGlobalWindow.cpp, line 1650]
nsGlobalWindow::TimerCallback()  [mozilla/dom/src/base/nsGlobalWindow.cpp, line 7172]
nsTimerImpl::Fire()  [mozilla/xpcom/threads/nsTimerImpl.cpp, line 384]
nsTimerEvent::Run()  [mozilla/xpcom/threads/nsTimerImpl.cpp, line 955]
nsThread::ProcessNextEvent()  [mozilla/xpcom/threads/nsThread.cpp, line 483]
NS_ProcessNextEvent_P()  [mozilla/xpcom/build/nsThreadUtils.cpp, line 227]
nsBaseAppShell::Run()  [mozilla/widget/src/xpwidgets/nsBaseAppShell.cpp, line 154]
nsAppStartup::Run()  [mozilla/toolkit/components/startup/src/nsAppStartup.cpp, line 172]
XRE_main()  [mozilla/toolkit/xre/nsAppRunner.cpp, line 2808]
main()  [mozilla/browser/app/nsBrowserApp.cpp, line 62]
libc.so.6 + 0x14ea2 (0xb745dea2)

Comment 1

[Mats Palmgren (inactive)]

Odd, I tried several different builds and I can't make it crash.
I also tried fiddling with the interval timer. (fwiw, Ubuntu 6.10)

Comment 2

[Martijn Wargers (dead)]

I was testing with a VMWare version of Ubuntu, in case that matters.

Comment 3

[Mats Palmgren (inactive)]

I installed Ubuntu 6.06.1-desktop under VMWare and I still can't crash it.
Is there anything else you installed in your image that I need?

Comment 5

[Mats Palmgren (inactive)]

Attachment: Patch rev. 1

1st hunk: this is the fix for the crash -- mFirstChild is null when the
child count is zero.  doh :-)

2nd hunk: we need to null out these members in Shutdown() as they are used to
protect all the other methods against calls after the DOM node was removed.

3rd hunk: kills a gcc compile warning

Comment 6

[Aaron Leventhal]

This might be a recent regression, see the patch in bug 380976. Does that fix this too?

Comment 7

[Mats Palmgren (inactive)]

Checked in to trunk at 2007-05-20 01:05 PDT.

-> FIXED

Comment 8

[Martijn Wargers (dead)]

Thanks! Verified fixed, using:
Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9a5pre) Gecko/20070520 Minefield/3.0a5pre