648988 - crash [@ nsIContent::Tag()]

Status: VERIFIED FIXED

(Core :: Disability Access APIs, defect)

Description

[Marco Zehe (:MarcoZ)]

This bug was filed from the Socorro interface and is 
report bp-733858f4-ab1e-42c9-bbe0-03a962110411 .
============================================================= 

The call is made from nsHypertExtAccessible::nativeState

Comment 1

[alexander :surkov (:asurkov)]

Trevor, you're call I think, looks as regression from your state patch.

Comment 2

[David Bolter [:davidb] (NeedInfo me for attention)]

Trevor, can you drop your try build link here when it is ready?

Comment 3

[Trevor Saunders (:tbsaunde)]

http://ftp.mozilla.org/pub/mozilla.org/firefox/tryserver-builds/[e-mail]-48e8c874a008/tryserver-win32/firefox-4.2a1pre.en-US.win32.zip

This build adds the IsDefunct check discussed on IRC.  Would  someone with a windows machine mind testing?  Sorry about the delay tryserver took forever :(

Comment 4

[alexander :surkov (:asurkov)]

bug 648989 has same problem (might need different patch though but it's unlikely).

Comment 5

[Trevor Saunders (:tbsaunde)]

Attachment: bug 648988 crash @ nsIContent::Tag()

Comment 6

[alexander :surkov (:asurkov)]

Comment on attachment 525271 [details] [diff] [review]
bug 648988 crash @ nsIContent::Tag()


> PRUint64
> nsAccessible::State()
> {
>+  if (IsDefunct())
>+    return states::DEFUNCT;
>+
>   PRUint64 state = NativeState();
>   if (state & states::DEFUNCT)
>     return state;

no need to check it

> PRUint64
> nsApplicationAccessible::NativeState()
> {
>-  return IsDefunct() ? states::DEFUNCT : 0;
>+  return 0;

then you should fix nsApplicationAccessible::State()

Comment 7

[Trevor Saunders (:tbsaunde)]

Attachment: patch to land

Comment 8

[Trevor Saunders (:tbsaunde)]

Attachment: patch to land

correctly fix nsApplicationAccessible::State()

Comment 9

[Marco Zehe (:MarcoZ)]

I can still reproduce the crashes with the try-server build. It also doesn't fix bug 648989.

Comment 10

[Marco Zehe (:MarcoZ)]

Forget that last comment, after talking to Trevor on IRC, it iis apparrent the try-server build I was testing was bad, and the patch on this bug is actually good to go.

Comment 11

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

http://hg.mozilla.org/mozilla-central/rev/15dc9bbc94d6

Comment 12

[Marco Zehe (:MarcoZ)]

The try-server build here:
http://ftp.mozilla.org/pub/mozilla.org/firefox/tryserver-builds/[e-mail]-4546f104f670/tryserver-win32/
fixes this bug. So the patch that landed seems to be good. Will confirm with nightly build as soon as it's ready.

Comment 13

[Marco Zehe (:MarcoZ)]

Verified fixed in Mozilla/5.0 (Windows NT 6.1; WOW64; rv:5.0a2) Gecko/20110412 Firefox/5.0a2

Comment 14

[Marco Zehe (:MarcoZ)]

Backed out of Aurora in the wake of the bug 634218 backout:
http://hg.mozilla.org/mozilla-aurora/rev/bcc0d10b5d4b

Comment 15

[Marco Zehe (:MarcoZ)]

Sorry for the spam, the correct link of the backout changeset on Aurora is:
http://hg.mozilla.org/mozilla-aurora/rev/25feb8bd6294