Reports both from 3.0b5 as well as 3.0pre.
Frames seem to indicate the line calling GetXPAccessibleFor:
Again, not a significant number of crashes to block. Marco, do we have any idea of how many beta testers are using accessibility?
(In reply to comment #1)
> Again, not a significant number of crashes to block. Marco, do we have any
> idea of how many beta testers are using accessibility?
Unfortunately not. This one, along with some of the others, looks like someone was experimenting with calling our APIs and giving us wrong parameters, and we're not protecting properly against those cases. Alexander Surkov filed bug 429990 to deal with all these in one big sweep, but I am not sure we want to try and take this for 1.9 or wait until Firefox 3 ships.
Mass un-assigning bugs assigned to Aaron.
Is this bug stale?
almost non-existent, but still there http://crash-stats.mozilla.com/query/query?product=Firefox&version=ALL%3AALL&date=&range_value=4&range_unit=weeks&query_search=signature&query_type=exact&query=nsAccessibleWrap%3A%3Aget_accKeyboardShortcut%28tagVARIANT%2C+unsigned+short**%29&do_query=1
Still valid - https://crash-stats.mozilla.com/report/index/2a16219f-c666-4e17-9a29-b90642110306
I get essentially the same stack from Visual C++, although the nsTArray frame is not there. Either the stack is corrupted, or some memory is corrupted and we're calling something we shouldn't be.
Created attachment 541899 [details] [diff] [review]
I think we want these checks any way and hopefully it'll fix the crashes.
Comment on attachment 541899 [details] [diff] [review]
Review of attachment 541899 [details] [diff] [review]:
r=me since the patch makes sense
@@ +494,5 @@
> + nsAutoString shortcut;
> + nsresult rv = xpAccessible->GetKeyboardShortcut(shortcut);
> + if (NS_FAILED(rv))
> + return E_FAIL;
Created attachment 542645 [details] [diff] [review]
fix return value