386836 - Same <map> used in several <img> caused Firefox crash

Status: RESOLVED FIXED

(Core :: Disability Access APIs, defect)

Description

[Ginn Chen]

Attachment: test case

Steps:
1) Load the testcase page
2) Try to traversal every a11y node in html container with accerciser
If you're using debug build of Firefox, you will see
###!!! ASSERTION: Stealing child!: '!parent || parent == this', file nsAccessible.cpp, line 467 in terminal

3) Close the page, Firefox crashed.

Comment 1

[Ginn Chen]

reusing same <map> will make several nsHTMLImageAccessible have same set of nsHTMLAreaAccessible children.

It will crash Firefox when we're shutting down all the accessibles in the page.

Comment 2

[alexander :surkov (:asurkov)]

I think we should create area accessibles for each image even these images share area nodes. I'll try the approach.

Comment 3

[alexander :surkov (:asurkov)]

Attachment: patch

does it help?

Comment 4

[Ginn Chen]

the patch looks good.

but it seems it doesn't work correctly, I will debug it to find out why.

Comment 5

[Ginn Chen]

Attachment: patch v2 based on surkov's

Updated to HEAD and fixed 2 problems
1) mAccessNodeCache needs to be nsnull by default
2) return created HTMLAreaAccessible in nsHTMLImageAccessible::GetAreaAccessible

Comment 6

[alexander :surkov (:asurkov)]

Comment on attachment 272466 [details] [diff] [review]
patch v2 based on surkov's

Ginn, thank you for fixing this.

Comment 7

[alexander :surkov (:asurkov)]

checked in