Closed Bug 528311 Opened 10 years ago Closed 10 years ago

Crash [@ nsXULTreeAccessible::GetTreeItemAccessible(int, nsIAccessible**) ]

Categories

(Core :: Disability Access APIs, defect, critical)

1.9.2 Branch
x86
Windows Vista
defect
Not set
critical

Tracking

()

RESOLVED FIXED
Tracking Status
status1.9.2 --- beta5-fixed

People

(Reporter: MarcoZ, Assigned: surkov)

References

Details

(Keywords: crash, regression, Whiteboard: [crashkill][crashkill-fix])

Crash Data

Attachments

(2 files)

Harvested from the QA IRC channel. Full report is here:
bp-f28314a0-9571-43c9-9729-737ed2091112

Wasn't reproducible, but might be in our new tables code. Surkov, can you look?
I got this crash two times with different actions:

1. Using the Search bar at the right of the location bar, writing a search term very fast into it:
http://crash-stats.mozilla.com/report/index/bp-f28314a0-9571-43c9-9729-737ed2091112

2. Running a login test; during that I had to override a saved user name and password. Whilst entering a random term in there, I got a Firefox crash. 
http://crash-stats.mozilla.com/report/index/bp-3d4beab2-6609-4f3a-b763-2cbdf2091111
The problem is we don't check the accessible is defunct. It should be fixed by bug 342045. I'll put special patch for 1.9.2 since the bug 342045 isn't going to be landed on branch.
Attached patch patchSplinter Review
trivial fix
Assignee: nobody → surkov.alexander
Status: NEW → ASSIGNED
Attachment #412130 - Flags: review?(marco.zehe)
Comment on attachment 412130 [details] [diff] [review]
patch

r=me. thanks!

Null check fix.
Attachment #412130 - Flags: review?(marco.zehe)
Attachment #412130 - Flags: review+
Attachment #412130 - Flags: approval1.9.2?
Flags: blocking1.9.2?
Blocks: 503727
Keywords: regression
Flags: blocking1.9.2? → blocking1.9.2+
Attachment #412130 - Flags: approval1.9.2? → approval1.9.2+
Landed on 1.9.2 on Alexander's behalf: http://hg.mozilla.org/releases/mozilla-1.9.2/rev/8227d87c6991

Note that this hasn't landed on mozilla-central on Surkov's request, who wants to put this fix as part of bug 342045. Leaving the bug open in general because of that.

Alex, please mark as fixed when you have all review for bug 342045 and have landed that.
Depends on: 342045
this is the top reported regression patch going from 3.6b1 to 3.6b2 in some new kinds of crash analysis that we are doing.  

does that info sound like it could be correct? here is the report

http://people.mozilla.com/~chofmann/crash-data/new-crashes/new-in-3.6b2-from-35x+36b1.html

sounds like this fix didn't make it into beta3.  are we pretty sure it covers the whole problem or might the patch need a beta cycle to confirm?
Yes, this covers this particular report. It didn't make it into beta 3, so we'll see results in the Namoroka nightlies starting  November 17 and in the next public refresh, whether that'd be beta 4 or RC or whatever.
Whiteboard: [crashkill][crashkill-fix]
(In reply to comment #9)

> Source file doesn't contain a fix
> (http://hg.mozilla.org/releases/mozilla-1.9.2/annotate/4c488520d1bf/accessible/src/xul/nsXULTreeAccessible.cpp#l551).

It does, sorry for the spam.
Attached patch patch2Splinter Review
Attachment #415053 - Flags: review?(marco.zehe)
Comment on attachment 415053 [details] [diff] [review]
patch2

r=me thanks!
Attachment #415053 - Flags: review?(marco.zehe) → review+
Comment on attachment 415053 [details] [diff] [review]
patch2

easy null-check fix
Attachment #415053 - Flags: approval1.9.2?
Comment on attachment 415053 [details] [diff] [review]
patch2

cancelling approval request since bug is marked as blocking
Attachment #415053 - Flags: approval1.9.2?
Status: ASSIGNED → RESOLVED
Closed: 10 years ago
Resolution: --- → FIXED
good stuff!

this will knock out #12 topcrash on 3.6b4 when it shows up in the next beta/rc.

and kill a regression from 35.5.5

checking --- 20091130-crashdata.csv nsXULTreeAccessible::GetTreeItemAccessible
release total-crashes
              nsXULTreeAccessible::GetTreeItemAccessible crashes
                         pct.
total	233706	165	0.000706015
3.0.15	50334		0
3.5.5	122547		0
3.6b4	16576	140	0.00844595
3.6b3	2703	16	0.00591935
3.6b2	1193	9	0.00754401
3.6b1	2776		0
Crash Signature: [@ nsXULTreeAccessible::GetTreeItemAccessible(int, nsIAccessible**) ]
You need to log in before you can comment on or make changes to this bug.