432869 - Divide by zero [@ IsProbablyForLayout]

Status: RESOLVED FIXED

(Core :: Disability Access APIs, defect)

Description

[Aaron Leventhal]

Not a common crash, but it's happened twice in the last week:

http://crash-stats.mozilla.com/report/list?range_unit=weeks&query_search=stack&query_type=contains&version=Firefox%3A3.0pre%2CSeaMonkey%3A2.0a1pre%2CSunbird%3A0.6a1%2CThunderbird%3A3.0a1pre&signature=nsHTMLTableAccessible%3A%3AIsProbablyForLayout(int*)&query=Accessi&range_value=1

Comment 1

[Aaron Leventhal]

Attachment: Never divide by 0 !

Comment 2

[alexander :surkov (:asurkov)]

Comment on attachment 320035 [details] [diff] [review]
Never divide by 0 !

>     // See bug 376803.
>     *aState |= nsIAccessibleStates::STATE_FOCUSABLE;
>+    if (gLastFocusedNode == mDOMNode) {
>+      *aState |= nsIAccessibleStates::STATE_FOCUSED;
>+    }

it seems that's from another bug, otherwise r=me

Comment 3

[Marco Zehe (:MarcoZ)]

Should  we nominate this for a potential RC2?

Comment 4

[Aaron Leventhal]

Marco, there is no risk with this bug. I recommend it for RC2.

Surkov, you're right that piece was from a different bug.

Comment 5

[Marco Zehe (:MarcoZ)]

Nominating for inclusion into RC2, if we have one.

Comment 6

[Marco Zehe (:MarcoZ)]

Aaron, Surkov, any thoughts on an HTML construct that could provoke this bug? I would want to put a test to this bug if possible.

Comment 7

[Marco Zehe (:MarcoZ)]

Pushed to mozilla-central in changeset:
http://hg.mozilla.org/mozilla-central/index.cgi/rev/453d67321c76

Leaving open for possible inclusion in 1.9.0.x.

Comment 8

[Aaron Leventhal]

Perhaps a <table> inside of an iframe with visibility:hidden or that sets a 0 width

Pretty to hard to figure out how to repro.

But it's a safe fix.

Comment 9

[Marco Zehe (:MarcoZ)]

Comment on attachment 320035 [details] [diff] [review]
Never divide by 0 !

This was harvested from crash-stats. Unfortunately the submitter did not leave a comment as to where the crashes happened. Probably a weird layout table of some sort.

As stated earlier, this is a safe fix that only makes sure we don't run into a divide by zero. Requesting that this be allowed to land on 1.9.0.1.

Comment 10

[Marco Zehe (:MarcoZ)]

Setting to resolved in accordance with rules laid out by Sam in mozilla.dev.planning. Fix was pushed to mozilla-central on June 11, see comment #7.

Comment 11

[Samuel Sidler (old account; do not CC)]

Comment on attachment 320035 [details] [diff] [review]
Never divide by 0 !

Approved for 1.9.0.2. Please land in CVS. a=ss

(Can we also get a test for this?)

Comment 12

[Marco Zehe (:MarcoZ)]

I tried a few things as suggested by Aaron in comment #8, but was unsuccessful in reproducing the crash. I tried a document with its width set to 0 and the table set to 85% of that, an iframe witha  width set to 0px, an iframe with visibility: hidden; or the like, but nothing of that sort crashed Firefox.

Comment 13

[Marco Zehe (:MarcoZ)]

Checking in accessible/src/html/nsHTMLTableAccessible.cpp;
/cvsroot/mozilla/accessible/src/html/nsHTMLTableAccessible.cpp,v  <--  nsHTMLTableAccessible.cpp
new revision: 1.65; previous revision: 1.64
done

Comment 14

[Marco Zehe (:MarcoZ)]

Finally got word of a testcase for this one, see URL field. It crashes upon load with Firefox 3.0.1, but no longer does with 3.1.

Comment 15

[Al Billings [:abillings - ex-MoCo]]

I cannot get 3.01 to crash on http://www.markizatext.sk/. What OS are you using?

Comment 16

[Marco Zehe (:MarcoZ)]

Al, the user who was reporting the website used either Windows XP or Windows Vista with the NVDA screen reader.

Comment 17

[Al Billings [:abillings - ex-MoCo]]

Do you have the NVDA screen reader, Marco? I don't have any screen readers here (on Windows or otherwise set up).

Comment 18

[Marco Zehe (:MarcoZ)]

Yes, I do have it. I cannot reproduce the crash in 3.0.2 or 3.1b1pre, but I saw a crash with it with 3.0.1.

Comment 19

[Firefox Bug Husbandry Bot]

https://bugzilla.mozilla.org/show_bug.cgi?id=1527381