578794 - navigating through an ARIA datagrid with JAWS running will cause firefox to stop responding.

Status: RESOLVED INVALID

(Core :: Disability Access APIs, defect)

Description

[Ryan]

User-Agent:       Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; en-US; rv:1.9.2.6) Gecko/20100625 Firefox/3.6.6
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2.6) Gecko/20100625 Firefox/3.6.6

if you try to navigate through the datagrid on this url using the arrow keys eventually it will cause firefox to stop responding completely, it does not just crash the tab, nor does it cause the mozilla crash reporter to come up, it just stops responding completely.

Reproducible: Always

Steps to Reproduce:
1. open http://codespeicher.com/jaws/gradebook_test.html
2. make sure JAWS is running
3. navigate the datagrid table.
4. it will cause firefox to freeze.
Actual Results:  
firefox stopped responding

Expected Results:  
firefox does not crash

it only breaks if JAWS is running.

Comment 1

[timeless]

https://developer.mozilla.org/en/How_to_get_a_stacktrace_with_WinDbg

Comment 2

[Ryan]

Attachment: stack trace of problem from WinDbg

I followed the instructions on: https://developer.mozilla.org/en/How_to_get_a_stacktrace_with_WinDbg
and got a stacktrace using WinDbg.
I hope this is helpful.  I ran it with jaws running too.  I am a little worried about it though because, with the debugger attached it crashed as soon as I focused on the first gridcell, normally it would take a few arrow key presses before it would crash withouth the debugger attached and just JAWS running.  also, I was using jaws 11.0.1461 when i did this.

Comment 3

[timeless]

HEAP[firefox.exe]: Invalid Address specified to RtlFreeHeap( 00150000, 00818314 )
(890.b98): Break instruction exception - code 80000003 (first chance)
eax=0081830c ebx=0081830c ecx=7c91ead5 edx=0012732e esi=00150000 edi=0081830c
eip=7c90120e esp=00127538 ebp=0012753c iopl=0         nv up ei pl nz na po nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000202
ntdll!DbgBreakPoint:
7c90120e cc              int     3
0:000> |* !analyze -v -f

STACK_TEXT:  
00127534 7c96e139 00127550 7c96e576 0081830c ntdll!DbgBreakPoint
0012753c 7c96e576 0081830c 00150000 00818314 ntdll!RtlpBreakPointHeap+0x28
00127550 7c96f75e 00150000 0081830c 7c96f914 ntdll!RtlpValidateHeapEntry+0x113
001275c4 7c94bc4c 00150000 50000061 00818314 ntdll!RtlDebugFreeHeap+0x97
001276ac 7c927573 00150000 40000060 00818314 ntdll!RtlFreeHeapSlowly+0x37
0012777c 774fd01c 00150000 00000000 00818314 ntdll!RtlFreeHeap+0xf9
00127790 774fd057 77606034 00818314 00127804 ole32!CRetailMalloc_Free+0x1c
001277a0 1500727f 00818314 26e490c9 00000000 ole32!CoTaskMemFree+0x13
WARNING: Stack unwind information not available. Following frames may be wrong.
00127804 1500c661 00818314 00000001 15052c7c jhook+0x727f
0012787c 1500dd3a 02406340 00000003 00000000 jhook+0xc661
0012816c 0069007a 006c006c 00570061 006e0069 jhook+0xdd3a
00128170 006c006c 00570061 006e0069 006f0064 0x69007a
00128174 00570061 006e0069 006f0064 00430077 0x6c006c

More or less this means that Jaws did something bad. In order to get something more useful from this, you'd have to contact a jaws developer. They'd either have to give you jhook.pdb, or ask you for a .dmp file from this process.

The .dmp could contain some private information (although this can be managed somewhat if you choose to be paranoid).

I don't know offhand whom we have as a jaws contact, so I'm hoping someone will CC them (or that you'll file a report directly to jaws referencing this bug).

Comment 4

[David Bolter [:davidb] (NeedInfo me for attention)]

I've notified my contact at FS (RobG). Thanks for the report and triage guys.

Comment 5

[David Bolter [:davidb] (NeedInfo me for attention)]

Note I'll close this once I confirm FS is aware of the issue.

Comment 6

[David Bolter [:davidb] (NeedInfo me for attention)]

OK, made contact. Closing - thanks again.

Comment 7

[David Bolter [:davidb] (NeedInfo me for attention)]

Cc'ing Brett from FS.