Crash [@ nsAccessibleWrap::get_accKeyboardShortcut(tagVARIANT, unsigned short**) ]

RESOLVED FIXED in mozilla7

Status

()

Core
Disability Access APIs
--
critical
RESOLVED FIXED
10 years ago
6 years ago

People

(Reporter: MarcoZ, Assigned: tbsaunde)

Tracking

({access, crash})

Trunk
mozilla7
x86
Windows XP
access, crash
Points:
---
Bug Flags:
blocking1.9 -

Firefox Tracking Flags

(Not tracked)

Details

(crash signature)

Attachments

(1 attachment, 1 obsolete attachment)

(Reporter)

Description

10 years ago
Reports both from 3.0b5 as well as 3.0pre. 
http://crash-stats.mozilla.com/report/list?range_unit=weeks&query_search=signature&query_type=contains&product=Firefox&platform=windows%2Cmac%2Clinux&version=Firefox%3A3.0b5%2CFirefox%3A3.0pre&branch=1.9&signature=nsAccessibleWrap%3A%3Aget_accKeyboardShortcut(tagVARIANT%2C+unsigned+short**)&query=Access&range_value=1
Frames seem to indicate the line calling GetXPAccessibleFor:
http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/accessible/src/msaa/nsAccessibleWrap.cpp&rev=1.117&mark=571#571
Flags: blocking1.9?
Again, not a significant number of crashes to block.  Marco, do we have any idea of how many beta testers are using accessibility?

Flags: blocking1.9? → blocking1.9-
(Reporter)

Comment 2

10 years ago
(In reply to comment #1)
> Again, not a significant number of crashes to block.  Marco, do we have any
> idea of how many beta testers are using accessibility?

Unfortunately not. This one, along with some of the others, looks like someone was experimenting with calling our APIs and giving us wrong parameters, and we're not protecting properly against those cases. Alexander Surkov filed bug 429990 to deal with all these in one big sweep, but I am not sure we want to try and take this for 1.9 or wait until Firefox 3 ships.
Mass un-assigning bugs assigned to Aaron.
Assignee: aaronleventhal → nobody
Is this bug stale?
almost non-existent, but still there http://crash-stats.mozilla.com/query/query?product=Firefox&version=ALL%3AALL&date=&range_value=4&range_unit=weeks&query_search=signature&query_type=exact&query=nsAccessibleWrap%3A%3Aget_accKeyboardShortcut%28tagVARIANT%2C+unsigned+short**%29&do_query=1
Severity: major → critical

Comment 6

7 years ago
Still valid - https://crash-stats.mozilla.com/report/index/2a16219f-c666-4e17-9a29-b90642110306

Updated

7 years ago
Target Milestone: mozilla1.9 → ---
I get essentially the same stack from Visual C++, although the nsTArray frame is not there. Either the stack is corrupted, or some memory is corrupted and we're calling something we shouldn't be.
Crash Signature: [@ nsAccessibleWrap::get_accKeyboardShortcut(tagVARIANT, unsigned short**) ]
(Assignee)

Comment 8

6 years ago
Created attachment 541899 [details] [diff] [review]
patch

I think we want these checks any way and hopefully it'll fix the crashes.
Attachment #541899 - Flags: review?(surkov.alexander)

Comment 9

6 years ago
Comment on attachment 541899 [details] [diff] [review]
patch

Review of attachment 541899 [details] [diff] [review]:
-----------------------------------------------------------------

r=me since the patch makes sense

::: accessible/src/msaa/nsAccessibleWrap.cpp
@@ +494,5 @@
>  
> +  nsAutoString shortcut;
> +  nsresult rv = xpAccessible->GetKeyboardShortcut(shortcut);
> +  if (NS_FAILED(rv))
> +    return E_FAIL;

return GetHRESULT(rv);
Attachment #541899 - Flags: review?(surkov.alexander) → review+

Updated

6 years ago
Assignee: nobody → trev.saunders
(Assignee)

Comment 10

6 years ago
Created attachment 542645 [details] [diff] [review]
patch

fix return value
Attachment #541899 - Attachment is obsolete: true
(Assignee)

Comment 11

6 years ago
landed http://hg.mozilla.org/mozilla-central/rev/1d351cc0e8c1
Status: NEW → RESOLVED
Last Resolved: 6 years ago
Resolution: --- → FIXED
(Assignee)

Updated

6 years ago
Target Milestone: --- → mozilla7
You need to log in before you can comment on or make changes to this bug.