528311 - Crash [@ nsXULTreeAccessible::GetTreeItemAccessible(int, nsIAccessible**) ]

Status: RESOLVED FIXED

(Core :: Disability Access APIs, defect)

Description

[Marco Zehe (:MarcoZ)]

Harvested from the QA IRC channel. Full report is here:
bp-f28314a0-9571-43c9-9729-737ed2091112

Wasn't reproducible, but might be in our new tables code. Surkov, can you look?

Comment 1

[Tobias (:Tobbi) Markus]

I got this crash two times with different actions:

1. Using the Search bar at the right of the location bar, writing a search term very fast into it:
http://crash-stats.mozilla.com/report/index/bp-f28314a0-9571-43c9-9729-737ed2091112

2. Running a login test; during that I had to override a saved user name and password. Whilst entering a random term in there, I got a Firefox crash. 
http://crash-stats.mozilla.com/report/index/bp-3d4beab2-6609-4f3a-b763-2cbdf2091111

Comment 2

[alexander :surkov (:asurkov)]

The problem is we don't check the accessible is defunct. It should be fixed by bug 342045. I'll put special patch for 1.9.2 since the bug 342045 isn't going to be landed on branch.

Comment 3

[alexander :surkov (:asurkov)]

Attachment: patch

trivial fix

Comment 4

[Marco Zehe (:MarcoZ)]

Comment on attachment 412130 [details] [diff] [review]
patch

r=me. thanks!

Null check fix.

Comment 5

[Marco Zehe (:MarcoZ)]

Landed on 1.9.2 on Alexander's behalf: http://hg.mozilla.org/releases/mozilla-1.9.2/rev/8227d87c6991

Note that this hasn't landed on mozilla-central on Surkov's request, who wants to put this fix as part of bug 342045. Leaving the bug open in general because of that.

Alex, please mark as fixed when you have all review for bug 342045 and have landed that.

Comment 6

[chris hofmann]

this is the top reported regression patch going from 3.6b1 to 3.6b2 in some new kinds of crash analysis that we are doing.  

does that info sound like it could be correct? here is the report

http://people.mozilla.com/~chofmann/crash-data/new-crashes/new-in-3.6b2-from-35x+36b1.html

sounds like this fix didn't make it into beta3.  are we pretty sure it covers the whole problem or might the patch need a beta cycle to confirm?

Comment 7

[Marco Zehe (:MarcoZ)]

Yes, this covers this particular report. It didn't make it into beta 3, so we'll see results in the Namoroka nightlies starting  November 17 and in the next public refresh, whether that'd be beta 4 or RC or whatever.

Comment 8

[David Baron :dbaron: (⌚️UTC-5, no longer working on Mozilla)]

This is still showing up as a topcrash in 3.6beta4:
http://crash-stats.mozilla.com/report/list?product=Firefox&version=Firefox%3A3.6b4&query_search=signature&query_type=exact&query=&date=&range_value=1&range_unit=weeks&do_query=1&signature=nsXULTreeAccessible%3A%3AGetTreeItemAccessible%28int%2C%20nsIAccessible%2A%2A%29

... so removing "beta4-fixed" annotation.

Comment 9

[alexander :surkov (:asurkov)]

(In reply to comment #8)
> This is still showing up as a topcrash in 3.6beta4:
> http://crash-stats.mozilla.com/report/list?product=Firefox&version=Firefox%3A3.6b4&query_search=signature&query_type=exact&query=&date=&range_value=1&range_unit=weeks&do_query=1&signature=nsXULTreeAccessible%3A%3AGetTreeItemAccessible%28int%2C%20nsIAccessible%2A%2A%29
> 

Source file doesn't contain a fix (http://hg.mozilla.org/releases/mozilla-1.9.2/annotate/4c488520d1bf/accessible/src/xul/nsXULTreeAccessible.cpp#l551).

Comment 10

[alexander :surkov (:asurkov)]

(In reply to comment #9)

> Source file doesn't contain a fix
> (http://hg.mozilla.org/releases/mozilla-1.9.2/annotate/4c488520d1bf/accessible/src/xul/nsXULTreeAccessible.cpp#l551).

It does, sorry for the spam.

Comment 11

[alexander :surkov (:asurkov)]

Attachment: patch2

Comment 12

[Marco Zehe (:MarcoZ)]

Comment on attachment 415053 [details] [diff] [review]
patch2

r=me thanks!

Comment 13

[alexander :surkov (:asurkov)]

Comment on attachment 415053 [details] [diff] [review]
patch2

easy null-check fix

Comment 14

[alexander :surkov (:asurkov)]

Comment on attachment 415053 [details] [diff] [review]
patch2

cancelling approval request since bug is marked as blocking

Comment 15

[alexander :surkov (:asurkov)]

landed on trunk (Gecko 1.9.3) - http://hg.mozilla.org/mozilla-central/rev/aabf9be2bb7d

Comment 16

[Boris Zbarsky [:bzbarsky]]

Pushed patch2 as http://hg.mozilla.org/releases/mozilla-1.9.2/rev/bf665a957cb2

Comment 17

[chris hofmann]

good stuff!

this will knock out #12 topcrash on 3.6b4 when it shows up in the next beta/rc.

and kill a regression from 35.5.5

checking --- 20091130-crashdata.csv nsXULTreeAccessible::GetTreeItemAccessible
release total-crashes
              nsXULTreeAccessible::GetTreeItemAccessible crashes
                         pct.
total	233706	165	0.000706015
3.0.15	50334		0
3.5.5	122547		0
3.6b4	16576	140	0.00844595
3.6b3	2703	16	0.00591935
3.6b2	1193	9	0.00754401
3.6b1	2776		0