516047 - crash [@ nsXULTreeGridCellAccessible::GetAttributesInternal(nsIPersistentProperties*)]

Status: RESOLVED FIXED

(Core :: Disability Access APIs, defect)

Description

[Wayne Mery (:wsmwk)]

#1 topcrash for 3.1a1pre crash [@ nsXULTreeGridCellAccessible::GetAttributesInternal(nsIPersistentProperties*)]
- first appears 2009082100.  no such crashes for 3.0<anything>

related to keyboard navigation of lists. comments include ...

bp-4ba1557d-1d9d-43ea-aae3-50b9f2090904
using imap mailboxes, was arrowing down in the junk folder, then pressed shift-home to select all messages from currnt to the top of the list. Pressed delete to move them all to the trash and got the crash.

bp-d7a95cc5-ca2a-4e7a-8381-c985f2090824
Started latest Shredder and pressed the end key while at the folder list. Twice in a row, it crashes.

bp-831b507d-1027-40e0-836d-1234d2090826
I have a gmail imap account and when I select all messages i a thread and delete them, I get this crash.

0	thunderbird.exe	nsXULTreeGridCellAccessible::GetAttributesInternal	 accessible/src/xul/nsXULTreeGridAccessible.cpp:1078
1	thunderbird.exe	nsAccessible::GetAttributes	accessible/src/base/nsAccessible.cpp:1683
2	thunderbird.exe	nsAccessibleWrap::get_accDescription	accessible/src/msaa/nsAccessibleWrap.cpp:377
3	oleacc.dll	AccWrap_Base::get_accDescription	
4	oleacc.dll	AccWrap_Annotate::get_accDescription	
5	gwm32inc.dll	gwm32inc.dll@0x16c4f	
6	gwm32inc.dll	gwm32inc.dll@0x1b0ea	
7	gwm32inc.dll	gwm32inc.dll@0x1c0c0	
8	gwm32inc.dll	gwm32inc.dll@0x1be09	
9	gwm32inc.dll	gwm32inc.dll@0x1c94e	
10	gwm32inc.dll	gwm32inc.dll@0x1c8cd	
11	user32.dll	user32.dll@0x231b8	
12	ntdll.dll	ntdll.dll@0x100e5	
13	thunderbird.exe	nsAccessibleWrap::FireAccessibleEvent	accessible/src/msaa/nsAccessibleWrap.cpp:1651
14	thunderbird.exe	nsAccUtils::FireAccEvent	accessible/src/base/nsAccUtils.cpp:353
15	thunderbird.exe	nsXULTreeGridCellAccessible::CellInvalidated	accessible/src/xul/nsXULTreeGridAccessible.cpp:1183
16	thunderbird.exe	nsXULTreeGridRowAccessible::RowInvalidated	accessible/src/xul/nsXULTreeGridAccessible.cpp:779
17	thunderbird.exe	nsXULTreeAccessible::TreeViewInvalidated	accessible/src/xul/nsXULTreeAccessible.cpp:694
18	thunderbird.exe	nsRootAccessible::HandleTreeInvalidatedEvent	accessible/src/base/nsRootAccessible.cpp:1227
19	thunderbird.exe	nsRootAccessible::HandleEventWithTarget	accessible/src/base/nsRootAccessible.cpp:671
20	thunderbird.exe	nsRootAccessible::HandleEvent	accessible/src/base/nsRootAccessible.cpp:587
21	thunderbird.exe	nsEventListenerManager::HandleEventSubType	content/events/src/nsEventListenerManager.cpp:1038
22	thunderbird.exe	nsEventListenerManager::HandleEvent	content/events/src/nsEventListenerManager.cpp:1144
23	thunderbird.exe	nsEventTargetChainItem::HandleEvent	content/events/src/nsEventDispatcher.cpp:244
24	thunderbird.exe	nsEventTargetChainItem::HandleEventTargetChain	content/events/src/nsEventDispatcher.cpp:279
25	thunderbird.exe	nsEventDispatcher::Dispatch	content/events/src/nsEventDispatcher.cpp:539
26	thunderbird.exe	nsEventDispatcher::DispatchDOMEvent	content/events/src/nsEventDispatcher.cpp:601
27	thunderbird.exe	nsEventListenerManager::DispatchEvent	content/events/src/nsEventListenerManager.cpp:1271
28	thunderbird.exe	nsDOMEventRTTearoff::DispatchEvent	content/base/src/nsGenericElement.cpp:1676
29	thunderbird.exe	nsPLDOMEvent::Run	content/events/src/nsPLDOMEvent.cpp:56
30	xpcom_core.dll	nsThread::ProcessNextEvent	xpcom/threads/nsThread.cpp:527
31	xpcom_core.dll	NS_ProcessNextEvent_P	objdir-tb/mozilla/xpcom/build/nsThreadUtils.cpp:230
32	thunderbird.exe	nsBaseAppShell::Run	widget/src/xpwidgets/nsBaseAppShell.cpp:170
33	thunderbird.exe	nsAppStartup::Run	toolkit/components/startup/src/nsAppStartup.cpp:182
34	thunderbird.exe	XRE_main	toolkit/xre/nsAppRunner.cpp:3477
35	thunderbird.exe	NS_internal_main	mail/app/nsMailApp.cpp:103
36	thunderbird.exe	wmain	toolkit/xre/nsWindowsWMain.cpp:110

Comment 1

[Marco Zehe (:MarcoZ)]

Alex, can you take a look?

Ludo, does TB 3.1a1pre build against mozilla-central or mozilla-1.9.2?

Comment 2

[Ludovic Hirlimann [:Usul]]

(In reply to comment #1)
> Ludo, does TB 3.1a1pre build against mozilla-central or mozilla-1.9.2?

mozilla-central.

Comment 3

[Marco Zehe (:MarcoZ)]

Alex, any chance you can take a look at this soon? This seems to be a direct regression from our IAccessibleTable2 patch and prevents GW Micro from testing this in Thunderbird nightlies, where it makes sense to test it. :) Thanks!

Comment 4

[Marco Zehe (:MarcoZ)]

Actually, scrub that. The bug where this particular code was introduced was bug 503727. It's just now being uncovered. The assumption that the grand parent of an nsXULTreeGridCellAccessible is always implementing the nsIAccessibleTable interface does not seem to be a valid assumption.

Comment 5

[alexander :surkov (:asurkov)]

I failed to reproduce the bug and it's not clear why this happens. All I can suggest is return-early approach in the meantime.

Comment 6

[David Bolter [:davidb] (NeedInfo me for attention)]

Attachment: fix (temporary)

Wayne, can you confirm this fix?

Comment 7

[David Bolter [:davidb] (NeedInfo me for attention)]

Comment on attachment 401426 [details] [diff] [review]
fix (temporary)

or Marco of course :)

Comment 8

[Wayne Mery (:wsmwk)]

Comment on attachment 401426 [details] [diff] [review]
fix (temporary)

sorry, I can neither confirm nor deny :)

I don't see the crash, I'm only reporting it per crashes listed at crash-stats

Comment 9

[Marco Zehe (:MarcoZ)]

Comment on attachment 401426 [details] [diff] [review]
fix (temporary)

r=me. Let's keep investigating why this is happening. Let's try to get exact steps from whatever the GW Micro folks are doing.

Comment 10

[David Bolter [:davidb] (NeedInfo me for attention)]

OK I'll throw this on trunk, and leave this bug open.

Comment 11

[David Bolter [:davidb] (NeedInfo me for attention)]

Pushed to trunk: http://hg.mozilla.org/mozilla-central/rev/91e7b6679516

Let's bake a day or two then make sure we backport this to whatever platform tbird 3.1+ is using. I'm not sure of the tbird schedule (?)

Comment 12

[Wayne Mery (:wsmwk)]

(In reply to comment #11)
> Pushed to trunk: http://hg.mozilla.org/mozilla-central/rev/91e7b6679516
> 
> Let's bake a day or two then make sure we backport this to whatever platform
> tbird 3.1+ is using. I'm not sure of the tbird schedule (?)

3.1 is using mozilla-central

Comment 13

[David Bolter [:davidb] (NeedInfo me for attention)]

(In reply to comment #12)
> 3.1 is using mozilla-central

Perfect thanks :)

Comment 14

[Marco Zehe (:MarcoZ)]

Comment on attachment 401426 [details] [diff] [review]
fix (temporary)

Once bug 503727 is approved, this needs to land along with it as a crasher regression fix. See https://wiki.mozilla.org/Accessibility/Remaining_Mozilla-1.9.2_Nominations for more details.

Comment 15

[Mike Beltzner [:beltzner, not reading bugmail]]

Comment on attachment 401426 [details] [diff] [review]
fix (temporary)

a192=beltzner

Comment 16

[alexander :surkov (:asurkov)]

landed on 1.9.2 - http://hg.mozilla.org/releases/mozilla-1.9.2/rev/09ebd06e9d93

Comment 17

[Marco Zehe (:MarcoZ)]

Verified fixed in Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2b2pre) Gecko/20091029 Namoroka/3.6b2pre (.NET CLR 3.5.30729)

Comment 18

[David Bolter [:davidb] (NeedInfo me for attention)]

trunk fixed via (dupe) bug 529192