Closed Bug 516047 Opened 12 years ago Closed 12 years ago

crash [@ nsXULTreeGridCellAccessible::GetAttributesInternal(nsIPersistentProperties*)]

Categories

(Core :: Disability Access APIs, defect)

x86
Windows XP
defect
Not set
critical

Tracking

()

RESOLVED FIXED
Tracking Status
status1.9.2 --- beta2-fixed

People

(Reporter: wsmwk, Assigned: davidb)

References

Details

(Keywords: crash, regression, verified1.9.2)

Crash Data

Attachments

(1 file)

#1 topcrash for 3.1a1pre crash [@ nsXULTreeGridCellAccessible::GetAttributesInternal(nsIPersistentProperties*)]
- first appears 2009082100.  no such crashes for 3.0<anything>

related to keyboard navigation of lists. comments include ...

bp-4ba1557d-1d9d-43ea-aae3-50b9f2090904
using imap mailboxes, was arrowing down in the junk folder, then pressed shift-home to select all messages from currnt to the top of the list. Pressed delete to move them all to the trash and got the crash.

bp-d7a95cc5-ca2a-4e7a-8381-c985f2090824
Started latest Shredder and pressed the end key while at the folder list. Twice in a row, it crashes.

bp-831b507d-1027-40e0-836d-1234d2090826
I have a gmail imap account and when I select all messages i a thread and delete them, I get this crash.

0	thunderbird.exe	nsXULTreeGridCellAccessible::GetAttributesInternal	 accessible/src/xul/nsXULTreeGridAccessible.cpp:1078
1	thunderbird.exe	nsAccessible::GetAttributes	accessible/src/base/nsAccessible.cpp:1683
2	thunderbird.exe	nsAccessibleWrap::get_accDescription	accessible/src/msaa/nsAccessibleWrap.cpp:377
3	oleacc.dll	AccWrap_Base::get_accDescription	
4	oleacc.dll	AccWrap_Annotate::get_accDescription	
5	gwm32inc.dll	gwm32inc.dll@0x16c4f	
6	gwm32inc.dll	gwm32inc.dll@0x1b0ea	
7	gwm32inc.dll	gwm32inc.dll@0x1c0c0	
8	gwm32inc.dll	gwm32inc.dll@0x1be09	
9	gwm32inc.dll	gwm32inc.dll@0x1c94e	
10	gwm32inc.dll	gwm32inc.dll@0x1c8cd	
11	user32.dll	user32.dll@0x231b8	
12	ntdll.dll	ntdll.dll@0x100e5	
13	thunderbird.exe	nsAccessibleWrap::FireAccessibleEvent	accessible/src/msaa/nsAccessibleWrap.cpp:1651
14	thunderbird.exe	nsAccUtils::FireAccEvent	accessible/src/base/nsAccUtils.cpp:353
15	thunderbird.exe	nsXULTreeGridCellAccessible::CellInvalidated	accessible/src/xul/nsXULTreeGridAccessible.cpp:1183
16	thunderbird.exe	nsXULTreeGridRowAccessible::RowInvalidated	accessible/src/xul/nsXULTreeGridAccessible.cpp:779
17	thunderbird.exe	nsXULTreeAccessible::TreeViewInvalidated	accessible/src/xul/nsXULTreeAccessible.cpp:694
18	thunderbird.exe	nsRootAccessible::HandleTreeInvalidatedEvent	accessible/src/base/nsRootAccessible.cpp:1227
19	thunderbird.exe	nsRootAccessible::HandleEventWithTarget	accessible/src/base/nsRootAccessible.cpp:671
20	thunderbird.exe	nsRootAccessible::HandleEvent	accessible/src/base/nsRootAccessible.cpp:587
21	thunderbird.exe	nsEventListenerManager::HandleEventSubType	content/events/src/nsEventListenerManager.cpp:1038
22	thunderbird.exe	nsEventListenerManager::HandleEvent	content/events/src/nsEventListenerManager.cpp:1144
23	thunderbird.exe	nsEventTargetChainItem::HandleEvent	content/events/src/nsEventDispatcher.cpp:244
24	thunderbird.exe	nsEventTargetChainItem::HandleEventTargetChain	content/events/src/nsEventDispatcher.cpp:279
25	thunderbird.exe	nsEventDispatcher::Dispatch	content/events/src/nsEventDispatcher.cpp:539
26	thunderbird.exe	nsEventDispatcher::DispatchDOMEvent	content/events/src/nsEventDispatcher.cpp:601
27	thunderbird.exe	nsEventListenerManager::DispatchEvent	content/events/src/nsEventListenerManager.cpp:1271
28	thunderbird.exe	nsDOMEventRTTearoff::DispatchEvent	content/base/src/nsGenericElement.cpp:1676
29	thunderbird.exe	nsPLDOMEvent::Run	content/events/src/nsPLDOMEvent.cpp:56
30	xpcom_core.dll	nsThread::ProcessNextEvent	xpcom/threads/nsThread.cpp:527
31	xpcom_core.dll	NS_ProcessNextEvent_P	objdir-tb/mozilla/xpcom/build/nsThreadUtils.cpp:230
32	thunderbird.exe	nsBaseAppShell::Run	widget/src/xpwidgets/nsBaseAppShell.cpp:170
33	thunderbird.exe	nsAppStartup::Run	toolkit/components/startup/src/nsAppStartup.cpp:182
34	thunderbird.exe	XRE_main	toolkit/xre/nsAppRunner.cpp:3477
35	thunderbird.exe	NS_internal_main	mail/app/nsMailApp.cpp:103
36	thunderbird.exe	wmain	toolkit/xre/nsWindowsWMain.cpp:110
Blocks: 512424
Component: Folder and Message Lists → Disability Access APIs
Product: Thunderbird → Core
QA Contact: folders-message-lists → accessibility-apis
Alex, can you take a look?

Ludo, does TB 3.1a1pre build against mozilla-central or mozilla-1.9.2?
(In reply to comment #1)
> Ludo, does TB 3.1a1pre build against mozilla-central or mozilla-1.9.2?

mozilla-central.
Alex, any chance you can take a look at this soon? This seems to be a direct regression from our IAccessibleTable2 patch and prevents GW Micro from testing this in Thunderbird nightlies, where it makes sense to test it. :) Thanks!
Actually, scrub that. The bug where this particular code was introduced was bug 503727. It's just now being uncovered. The assumption that the grand parent of an nsXULTreeGridCellAccessible is always implementing the nsIAccessibleTable interface does not seem to be a valid assumption.
Blocks: 503727
No longer blocks: 512424
I failed to reproduce the bug and it's not clear why this happens. All I can suggest is return-early approach in the meantime.
Attached patch fix (temporary)Splinter Review
Wayne, can you confirm this fix?
Attachment #401426 - Flags: review?(vseerror)
Comment on attachment 401426 [details] [diff] [review]
fix (temporary)

or Marco of course :)
Attachment #401426 - Flags: review?(marco.zehe)
Attachment #401426 - Flags: review?(vseerror)
Comment on attachment 401426 [details] [diff] [review]
fix (temporary)

sorry, I can neither confirm nor deny :)

I don't see the crash, I'm only reporting it per crashes listed at crash-stats
Comment on attachment 401426 [details] [diff] [review]
fix (temporary)

r=me. Let's keep investigating why this is happening. Let's try to get exact steps from whatever the GW Micro folks are doing.
Attachment #401426 - Flags: review?(marco.zehe) → review+
OK I'll throw this on trunk, and leave this bug open.
Pushed to trunk: http://hg.mozilla.org/mozilla-central/rev/91e7b6679516

Let's bake a day or two then make sure we backport this to whatever platform tbird 3.1+ is using. I'm not sure of the tbird schedule (?)
(In reply to comment #11)
> Pushed to trunk: http://hg.mozilla.org/mozilla-central/rev/91e7b6679516
> 
> Let's bake a day or two then make sure we backport this to whatever platform
> tbird 3.1+ is using. I'm not sure of the tbird schedule (?)

3.1 is using mozilla-central
(In reply to comment #12)
> 3.1 is using mozilla-central

Perfect thanks :)
Comment on attachment 401426 [details] [diff] [review]
fix (temporary)

Once bug 503727 is approved, this needs to land along with it as a crasher regression fix. See https://wiki.mozilla.org/Accessibility/Remaining_Mozilla-1.9.2_Nominations for more details.
Attachment #401426 - Flags: approval1.9.2?
Comment on attachment 401426 [details] [diff] [review]
fix (temporary)

a192=beltzner
Attachment #401426 - Flags: approval1.9.2? → approval1.9.2+
landed on 1.9.2 - http://hg.mozilla.org/releases/mozilla-1.9.2/rev/09ebd06e9d93
Assignee: nobody → bolterbugz
Verified fixed in Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2b2pre) Gecko/20091029 Namoroka/3.6b2pre (.NET CLR 3.5.30729)
trunk fixed via (dupe) bug 529192
Status: NEW → RESOLVED
Closed: 12 years ago
Resolution: --- → FIXED
Crash Signature: [@ nsXULTreeGridCellAccessible::GetAttributesInternal(nsIPersistentProperties*)]
You need to log in before you can comment on or make changes to this bug.