429661 - Crash [@ nsDocAccessible::FireShowHideEvents(nsIDOMNode*, int, unsigned int, int, int) ]

Status: RESOLVED FIXED

(Core :: Disability Access APIs, defect)

Description

[Marco Zehe (:MarcoZ)]

Found while triaging Firefox 3.0b5 crash reports in a11y module. One report:
bp-6ec6d707-0aa2-11dd-a4df-0013211cbf8a
The line implied is:
http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/accessible/src/base/nsDocAccessible.cpp&rev=1.238&mark=2067#2067
Looks like a simple NULL pointer check. Patch coming up.

Comment 1

[Marco Zehe (:MarcoZ)]

Attachment: add NULL check

Comment 2

[Aaron Leventhal]

Comment on attachment 316417 [details] [diff] [review]
add NULL check

We already check mDOMNode, so this would happen in the case where FireShowHideEvents() is called with the document node. The document node support nsIDOMNode but not nsIContent, so you'd get null for content.

We need to figure out how to do the right thing when the document is passed in. Maybe Ginn can look at this one.

Comment 3

[Marco Zehe (:MarcoZ)]

Ginn, can you?

Comment 4

[alexander :surkov (:asurkov)]

That's happen when InvalidateCacheSubtree() is called with nsnull (http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/accessible/src/base/nsDocAccessible.cpp&rev=1.238&mark=1797#1797)

Comment 5

[alexander :surkov (:asurkov)]

Attachment: patch

Comment 6

[Damon Sicore (:damons)]

Is this something that we need a test for?

Comment 7

[alexander :surkov (:asurkov)]

Comment on attachment 316572 [details] [diff] [review]
patch

(In reply to comment #6)
> Is this something that we need a test for?
>
 
We haven't a way to reproduce the bug. We just have stack trace leading to crash. I tried to do small changes I can. If the having of test is major condition for the current status of the tree then let's wait for 1.9.x to land this trying of the the crash fix.

re-requesting approval

Comment 8

[Damon Sicore (:damons)]

Comment on attachment 316572 [details] [diff] [review]
patch

a1.9+=damons

Comment 9

[alexander :surkov (:asurkov)]

Checking in accessible/src/base/nsDocAccessible.cpp;
/cvsroot/mozilla/accessible/src/base/nsDocAccessible.cpp,v  <-- 
nsDocAccessible.cpp
new revision: 1.240; previous revision: 1.239
done