Closed Bug 386836 Opened 13 years ago Closed 13 years ago

Same <map> used in several <img> caused Firefox crash

Categories

(Core :: Disability Access APIs, defect, critical)

x86
Linux
defect
Not set
critical

Tracking

()

RESOLVED FIXED

People

(Reporter: ginnchen+exoracle, Assigned: surkov)

References

Details

(Keywords: access, crash)

Attachments

(2 files, 1 obsolete file)

Attached file test case
Steps:
1) Load the testcase page
2) Try to traversal every a11y node in html container with accerciser
If you're using debug build of Firefox, you will see
###!!! ASSERTION: Stealing child!: '!parent || parent == this', file nsAccessible.cpp, line 467 in terminal

3) Close the page, Firefox crashed.
reusing same <map> will make several nsHTMLImageAccessible have same set of nsHTMLAreaAccessible children.

It will crash Firefox when we're shutting down all the accessibles in the page.
I think we should create area accessibles for each image even these images share area nodes. I'll try the approach.
Assignee: aaronleventhal → surkov.alexander
Attached patch patch (obsolete) — Splinter Review
does it help?
Attachment #270896 - Flags: review?(ginn.chen)
the patch looks good.

but it seems it doesn't work correctly, I will debug it to find out why.
Updated to HEAD and fixed 2 problems
1) mAccessNodeCache needs to be nsnull by default
2) return created HTMLAreaAccessible in nsHTMLImageAccessible::GetAreaAccessible
Attachment #270896 - Attachment is obsolete: true
Attachment #272466 - Flags: review?(surkov.alexander)
Attachment #270896 - Flags: review?(ginn.chen)
Comment on attachment 272466 [details] [diff] [review]
patch v2 based on surkov's

Ginn, thank you for fixing this.
Attachment #272466 - Flags: review?(surkov.alexander) → review+
checked in
Status: NEW → RESOLVED
Closed: 13 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.