Same <map> used in several <img> caused Firefox crash

RESOLVED FIXED

Status

()

Core
Disability Access APIs
--
critical
RESOLVED FIXED
11 years ago
11 years ago

People

(Reporter: Ginn Chen, Assigned: surkov)

Tracking

({access, crash})

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(2 attachments, 1 obsolete attachment)

(Reporter)

Description

11 years ago
Created attachment 270871 [details]
test case

Steps:
1) Load the testcase page
2) Try to traversal every a11y node in html container with accerciser
If you're using debug build of Firefox, you will see
###!!! ASSERTION: Stealing child!: '!parent || parent == this', file nsAccessible.cpp, line 467 in terminal

3) Close the page, Firefox crashed.
(Reporter)

Comment 1

11 years ago
reusing same <map> will make several nsHTMLImageAccessible have same set of nsHTMLAreaAccessible children.

It will crash Firefox when we're shutting down all the accessibles in the page.
(Assignee)

Comment 2

11 years ago
I think we should create area accessibles for each image even these images share area nodes. I'll try the approach.
Assignee: aaronleventhal → surkov.alexander
(Assignee)

Comment 3

11 years ago
Created attachment 270896 [details] [diff] [review]
patch

does it help?
Attachment #270896 - Flags: review?(ginn.chen)
(Reporter)

Comment 4

11 years ago
the patch looks good.

but it seems it doesn't work correctly, I will debug it to find out why.
(Reporter)

Comment 5

11 years ago
Created attachment 272466 [details] [diff] [review]
patch v2 based on surkov's

Updated to HEAD and fixed 2 problems
1) mAccessNodeCache needs to be nsnull by default
2) return created HTMLAreaAccessible in nsHTMLImageAccessible::GetAreaAccessible
Attachment #270896 - Attachment is obsolete: true
Attachment #272466 - Flags: review?(surkov.alexander)
Attachment #270896 - Flags: review?(ginn.chen)
(Assignee)

Comment 6

11 years ago
Comment on attachment 272466 [details] [diff] [review]
patch v2 based on surkov's

Ginn, thank you for fixing this.
Attachment #272466 - Flags: review?(surkov.alexander) → review+
(Assignee)

Comment 7

11 years ago
checked in
Status: NEW → RESOLVED
Last Resolved: 11 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.