396744 - Crash [@ nsAccessible::GetFinalState] with moving select, option and optgroup with display: none

Status: VERIFIED FIXED

(Core :: Disability Access APIs, defect)

Description

[Martijn Wargers (dead)]

Attachment: testcase

See testcase, which crashes current trunk builds after 500ms.
You need to download the testcase to your computer, because of the use of enhanced privileges.

It doesn't seem to crash on branch (I used the branch specific code for that), but it doesn't seem to crash there, so it might be a regression, somehow.

http://crash-stats.mozilla.com/report/index/36c06b8a-66d8-11dc-aca1-001a4bd43ef6
frame  	signature  	source
0 	nsAccessible::GetFinalState(unsigned int*, unsigned int*) 	mozilla/accessible/src/base/nsAccessible.cpp:2348
1 	nsHTMLSelectOptionAccessible::GetSelectState(unsigned int*, unsigned int*) 	mozilla/accessible/src/html/nsHTMLSelectAccessible.cpp:858
2 	nsHTMLSelectOptionAccessible::GetState(unsigned int*, unsigned int*) 	mozilla/accessible/src/html/nsHTMLSelectAccessible.cpp:613
3 	nsAccessible::GetFinalState(unsigned int*, unsigned int*) 	mozilla/accessible/src/base/nsAccessible.cpp:2297
4 	nsAccessible::State(nsIAccessible*) 	mozilla/accessible/src/base/nsAccessible.h:146
5 	nsAccessible::GetMultiSelectFor(nsIDOMNode*) 	mozilla/accessible/src/base/nsAccessible.cpp:1343
6 	nsHTMLSelectOptionAccessible::SelectionChangedIfOption(nsIContent*) 	mozilla/accessible/src/html/nsHTMLSelectAccessible.cpp:814
7 	nsDocAccessible::ContentStatesChanged(nsIDocument*, nsIContent*, nsIContent*, int) 	mozilla/accessible/src/base/nsDocAccessible.cpp:1200
8 	nsDocument::ContentStatesChanged(nsIContent*, nsIContent*, int) 	mozilla/content/base/src/nsDocument.cpp:2866
9 	nsHTMLOptionElement::SetSelectedInternal(int, int) 	mozilla/content/html/content/src/nsHTMLOptionElement.cpp:212
10 	nsHTMLSelectElement::OnOptionSelected(nsISelectControlFrame*, nsPresContext*, int, int, int) 	mozilla/content/html/content/src/nsHTMLSelectElement.cpp:846
etc..

Comment 1

[Aaron Leventhal]

Di you update to the 9/19 build? I put a fix in for a very similar bug.

Comment 2

[Martijn Wargers (dead)]

Yes, this was tested, with:
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a8pre) Gecko/2007091904 Minefield/3.0a8pre

Comment 3

[alexander :surkov (:asurkov)]

Attachment: patch

reorganize getFinalState to take into account frame may be null for some cases.

Comment 4

[Aaron Leventhal]

Comment on attachment 281620 [details] [diff] [review]
patch

Can you provide diff -w as well for this one please?

Comment 5

[alexander :surkov (:asurkov)]

Attachment: patch -w

Comment 6

[alexander :surkov (:asurkov)]

Attachment: patch -w

Comment 7

[Aaron Leventhal]

Comment on attachment 281640 [details] [diff] [review]
patch -w

Much easier to review :)

Thanks.

Comment 8

[alexander :surkov (:asurkov)]

checked in

Comment 9

[Martijn Wargers (dead)]

Verified fixed, using:
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a8pre) Gecko/2007092105 Minefield/3.0a8pre