391123 - Crash [@ nsHTMLComboboxListAccessible::GetState] with moving option and setting display: none on select

Status: VERIFIED FIXED

(Core :: Disability Access APIs, defect)

Description

[Martijn Wargers (dead)]

Attachment: testcase

See testcase, which crashes in current trunk build.
Because of the use of enhanced privileges, you need to download the testcase to your computer to see the crash.
It doesn't seem to crash on branch.

http://crash-stats.mozilla.com/report/index/903e26f8-4454-11dc-89c4-001a4bd46e84
0  	nsHTMLComboboxListAccessible::GetState(unsigned int*, unsigned int*)  	 e:\builds\tinderbox\fx-trunk\winnt_5.2_depend\mozilla\accessible\src\html\nshtmlselectaccessible.cpp:1405
1 	nsAccessible::GetFinalState(unsigned int*, unsigned int*) 	e:\builds\tinderbox\fx-trunk\winnt_5.2_depend\mozilla\accessible\src\base\nsaccessible.cpp:2289
2 	nsAccessible::State(nsIAccessible*) 	e:\builds\tinderbox\fx-trunk\winnt_5.2_depend\mozilla\accessible\src\base\nsaccessible.h:151
3 	nsRootAccessible::HandleEventWithTarget(nsIDOMEvent*, nsIDOMNode*) 	e:\builds\tinderbox\fx-trunk\winnt_5.2_depend\mozilla\accessible\src\base\nsrootaccessible.cpp:821
4 	nsRootAccessible::HandleEvent(nsIDOMEvent*) 	e:\builds\tinderbox\fx-trunk\winnt_5.2_depend\mozilla\accessible\src\base\nsrootaccessible.cpp:557
5 	nsEventListenerManager::HandleEventSubType(nsListenerStruct*, nsIDOMEventListener*, nsIDOMEvent*, nsISupports*, unsigned int) 	e:\builds\tinderbox\fx-trunk\winnt_5.2_depend\mozilla\content\events\src\nseventlistenermanager.cpp:1096
6 	nsEventListenerManager::HandleEvent(nsPresContext*, nsEvent*, nsIDOMEvent**, nsISupports*, unsigned int, nsEventStatus*) 	e:\builds\tinderbox\fx-trunk\winnt_5.2_depend\mozilla\content\events\src\nseventlistenermanager.cpp:1210
7 	nsEventTargetChainItem::HandleEvent(nsEventChainPostVisitor&, unsigned int) 	e:\builds\tinderbox\fx-trunk\winnt_5.2_depend\mozilla\content\events\src\nseventdispatcher.cpp:201
8 	nsEventTargetChainItem::HandleEventTargetChain(nsEventChainPostVisitor&, unsigned int, nsDispatchingCallback*) 	e:\builds\tinderbox\fx-trunk\winnt_5.2_depend\mozilla\content\events\src\nseventdispatcher.cpp:231
9 	nsEventDispatcher::Dispatch(nsISupports*, nsPresContext*, nsEvent*, nsIDOMEvent*, nsEventStatus*, nsDispatchingCallback*) 	e:\builds\tinderbox\fx-trunk\winnt_5.2_depend\mozilla\content\events\src\nseventdispatcher.cpp:473
10 	nsEventDispatcher::DispatchDOMEvent(nsISupports*, nsEvent*, nsIDOMEvent*, nsPresContext*, nsEventStatus*) 	e:\builds\tinderbox\fx-trunk\winnt_5.2_depend\mozilla\content\events\src\nseventdispatcher.cpp:531
11 	nsEventListenerManager::DispatchEvent(nsIDOMEvent*, int*) 	e:\builds\tinderbox\fx-trunk\winnt_5.2_depend\mozilla\content\events\src\nseventlistenermanager.cpp:1339
12 	nsDOMEventRTTearoff::DispatchEvent(nsIDOMEvent*, int*) 	e:\builds\tinderbox\fx-trunk\winnt_5.2_depend\mozilla\content\base\src\nsgenericelement.cpp:1005
13 	nsPLDOMEvent::Run() 	e:\builds\tinderbox\fx-trunk\winnt_5.2_depend\mozilla\content\events\src\nspldomevent.cpp:65
14 	nsThread::ProcessNextEvent(int, int*) 	e:\builds\tinderbox\fx-trunk\winnt_5.2_depend\mozilla\xpcom\threads\nsthread.cpp:490
15 	NS_ProcessNextEvent_P(nsIThread*, int) 	e:\builds\tinderbox\fx-trunk\winnt_5.2_depend\mozilla\obj-fx-trunk\xpcom\build\nsthreadutils.cpp:227
16 	nsBaseAppShell::Run() 	e:\builds\tinderbox\fx-trunk\winnt_5.2_depend\mozilla\widget\src\xpwidgets\nsbaseappshell.cpp:154
17 	nsAppStartup::Run() 	e:\builds\tinderbox\fx-trunk\winnt_5.2_depend\mozilla\toolkit\components\startup\src\nsappstartup.cpp:170
18 	XRE_main 	e:\builds\tinderbox\fx-trunk\winnt_5.2_depend\mozilla\toolkit\xre\nsapprunner.cpp:3057
19 	main 	e:\builds\tinderbox\fx-trunk\winnt_5.2_depend\mozilla\browser\app\nsbrowserapp.cpp:153
20 	WinMain 	e:\builds\tinderbox\fx-trunk\winnt_5.2_depend\mozilla\browser\app\nsbrowserapp.cpp:166
21 	__tmainCRTStartup 	f:\rtm\vctools\crt_bld\self_x86\crt\src\crtexe.c:578
22 	BaseProcessStart

Comment 1

[Evan Yan]

I can not reproduce this on 2007-08-13 build on Linux.

Aaron, can you reproduce this on Windows with a recent build?

Comment 2

[Martijn Wargers (dead)]

I can still see this, using:
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a8pre) Gecko/2007081605 Minefield/3.0a8pre

Comment 3

[Evan Yan]

Martijn, is that just download the testcase to local and open it in Firefox, then Firefox crash?

I test it on Windows, but still not see the crash. I must have missed something...

Comment 4

[Martijn Wargers (dead)]

(In reply to comment #3)
> Martijn, is that just download the testcase to local and open it in Firefox,
> then Firefox crash?
> 
> I test it on Windows, but still not see the crash. I must have missed
> something...

Yes, just download the testcase (by right-clicking and do "Save Target As..", not opening the page and do a File->Save Page As..).
Then when opening the testcase locally, it should crash.
If it doesn't crash, I guess it was denied the enhanced privileges. In that case, you could try in a new profile, it should then ask you if you want to grant the script enhanced privileges.

Comment 5

[Evan Yan]

(In reply to comment #4)
> Yes, just download the testcase (by right-clicking and do "Save Target As..",
> not opening the page and do a File->Save Page As..).

ah, I wrongly did the latter way. Now reproduced, thanks.

Comment 6

[Evan Yan]

Attachment: patch

the combobox is invisible due to display:table-row, so we get null frame.

Comment 7

[Evan Yan]

(In reply to comment #6)
> Created an attachment (id=277365) [details]
> patch
> 
> the combobox is invisible due to display:table-row, so we get null frame.
> 
sorry, my typo. I actually meant "display:none", not "display:table-row".

Comment 8

[Evan Yan]

/cvsroot/mozilla/accessible/src/html/nsHTMLSelectAccessible.cpp,v  <--  nsHTMLSelectAccessible.cpp
new revision: 1.89; previous revision: 1.88
done

Comment 9

[Martijn Wargers (dead)]

Thanks for fixing.

Verified fixed, using:
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a8pre) Gecko/2007082111 Minefield/3.0a8pre