429642 - Crash [@ nsAccessibleWrap::get_accKeyboardShortcut(tagVARIANT, unsigned short**) ]

Status: RESOLVED FIXED

(Core :: Disability Access APIs, defect)

Description

[Marco Zehe (:MarcoZ)]

Reports both from 3.0b5 as well as 3.0pre. 
http://crash-stats.mozilla.com/report/list?range_unit=weeks&query_search=signature&query_type=contains&product=Firefox&platform=windows%2Cmac%2Clinux&version=Firefox%3A3.0b5%2CFirefox%3A3.0pre&branch=1.9&signature=nsAccessibleWrap%3A%3Aget_accKeyboardShortcut(tagVARIANT%2C+unsigned+short**)&query=Access&range_value=1
Frames seem to indicate the line calling GetXPAccessibleFor:
http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/accessible/src/msaa/nsAccessibleWrap.cpp&rev=1.117&mark=571#571

Comment 1

[Damon Sicore (:damons)]

Again, not a significant number of crashes to block.  Marco, do we have any idea of how many beta testers are using accessibility?

Comment 2

[Marco Zehe (:MarcoZ)]

(In reply to comment #1)
> Again, not a significant number of crashes to block.  Marco, do we have any
> idea of how many beta testers are using accessibility?

Unfortunately not. This one, along with some of the others, looks like someone was experimenting with calling our APIs and giving us wrong parameters, and we're not protecting properly against those cases. Alexander Surkov filed bug 429990 to deal with all these in one big sweep, but I am not sure we want to try and take this for 1.9 or wait until Firefox 3 ships.

Comment 3

[David Bolter [:davidb] (NeedInfo me for attention)]

Mass un-assigning bugs assigned to Aaron.

Comment 4

[David Bolter [:davidb] (NeedInfo me for attention)]

Is this bug stale?

Comment 5

[Wayne Mery (:wsmwk)]

almost non-existent, but still there http://crash-stats.mozilla.com/query/query?product=Firefox&version=ALL%3AALL&date=&range_value=4&range_unit=weeks&query_search=signature&query_type=exact&query=nsAccessibleWrap%3A%3Aget_accKeyboardShortcut%28tagVARIANT%2C+unsigned+short**%29&do_query=1

Comment 6

[alexander :surkov (:asurkov)]

Still valid - https://crash-stats.mozilla.com/report/index/2a16219f-c666-4e17-9a29-b90642110306

Comment 7

[(not currently active) Ted Mielczarek]

I get essentially the same stack from Visual C++, although the nsTArray frame is not there. Either the stack is corrupted, or some memory is corrupted and we're calling something we shouldn't be.

Comment 8

[Trevor Saunders (:tbsaunde)]

Attachment: patch

I think we want these checks any way and hopefully it'll fix the crashes.

Comment 9

[alexander :surkov (:asurkov)]

Comment on attachment 541899 [details] [diff] [review]
patch

Review of attachment 541899 [details] [diff] [review]:
-----------------------------------------------------------------

r=me since the patch makes sense

::: accessible/src/msaa/nsAccessibleWrap.cpp
@@ +494,5 @@
>  
> +  nsAutoString shortcut;
> +  nsresult rv = xpAccessible->GetKeyboardShortcut(shortcut);
> +  if (NS_FAILED(rv))
> +    return E_FAIL;

return GetHRESULT(rv);

Comment 10

[Trevor Saunders (:tbsaunde)]

Attachment: patch

fix return value

Comment 11

[Trevor Saunders (:tbsaunde)]

landed http://hg.mozilla.org/mozilla-central/rev/1d351cc0e8c1