Last Comment Bug 648988 - crash [@ nsIContent::Tag()]
: crash [@ nsIContent::Tag()]
Status: VERIFIED FIXED
[aurora-backout]
: crash, topcrash
Product: Core
Classification: Components
Component: Disability Access APIs (show other bugs)
: Trunk
: x86 Windows NT
: -- critical (vote)
: mozilla6
Assigned To: Trevor Saunders (:tbsaunde)
:
Mentors:
Depends on:
Blocks: 634218
  Show dependency treegraph
 
Reported: 2011-04-11 07:02 PDT by Marco Zehe (:MarcoZ)
Modified: 2011-06-13 10:01 PDT (History)
4 users (show)
See Also:
Crash Signature:
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments
bug 648988 crash @ nsIContent::Tag() (10.19 KB, patch)
2011-04-11 19:11 PDT, Trevor Saunders (:tbsaunde)
surkov.alexander: review+
Details | Diff | Splinter Review
patch to land (7.90 KB, patch)
2011-04-11 19:35 PDT, Trevor Saunders (:tbsaunde)
no flags Details | Diff | Splinter Review
patch to land (10.79 KB, patch)
2011-04-11 19:52 PDT, Trevor Saunders (:tbsaunde)
no flags Details | Diff | Splinter Review

Description Marco Zehe (:MarcoZ) 2011-04-11 07:02:08 PDT
This bug was filed from the Socorro interface and is 
report bp-733858f4-ab1e-42c9-bbe0-03a962110411 .
============================================================= 

The call is made from nsHypertExtAccessible::nativeState
Comment 1 alexander :surkov 2011-04-11 07:12:23 PDT
Trevor, you're call I think, looks as regression from your state patch.
Comment 2 David Bolter [:davidb] ***PTO until 29th*** 2011-04-11 12:55:47 PDT
Trevor, can you drop your try build link here when it is ready?
Comment 3 Trevor Saunders (:tbsaunde) 2011-04-11 16:38:17 PDT
http://ftp.mozilla.org/pub/mozilla.org/firefox/tryserver-builds/trev.saunders@gmail.com-48e8c874a008/tryserver-win32/firefox-4.2a1pre.en-US.win32.zip

This build adds the IsDefunct check discussed on IRC.  Would  someone with a windows machine mind testing?  Sorry about the delay tryserver took forever :(
Comment 4 alexander :surkov 2011-04-11 17:46:36 PDT
bug 648989 has same problem (might need different patch though but it's unlikely).
Comment 5 Trevor Saunders (:tbsaunde) 2011-04-11 19:11:36 PDT
Created attachment 525271 [details] [diff] [review]
bug 648988 crash @ nsIContent::Tag()
Comment 6 alexander :surkov 2011-04-11 19:23:05 PDT
Comment on attachment 525271 [details] [diff] [review]
bug 648988 crash @ nsIContent::Tag()


> PRUint64
> nsAccessible::State()
> {
>+  if (IsDefunct())
>+    return states::DEFUNCT;
>+
>   PRUint64 state = NativeState();
>   if (state & states::DEFUNCT)
>     return state;

no need to check it

> PRUint64
> nsApplicationAccessible::NativeState()
> {
>-  return IsDefunct() ? states::DEFUNCT : 0;
>+  return 0;

then you should fix nsApplicationAccessible::State()
Comment 7 Trevor Saunders (:tbsaunde) 2011-04-11 19:35:39 PDT
Created attachment 525279 [details] [diff] [review]
patch to land
Comment 8 Trevor Saunders (:tbsaunde) 2011-04-11 19:52:17 PDT
Created attachment 525284 [details] [diff] [review]
patch to land

correctly fix nsApplicationAccessible::State()
Comment 9 Marco Zehe (:MarcoZ) 2011-04-11 21:34:10 PDT
I can still reproduce the crashes with the try-server build. It also doesn't fix bug 648989.
Comment 10 Marco Zehe (:MarcoZ) 2011-04-11 23:03:38 PDT
Forget that last comment, after talking to Trevor on IRC, it iis apparrent the try-server build I was testing was bad, and the patch on this bug is actually good to go.
Comment 11 David Baron :dbaron: ⌚️UTC-7 (review requests must explain patch) 2011-04-12 00:27:25 PDT
http://hg.mozilla.org/mozilla-central/rev/15dc9bbc94d6
Comment 12 Marco Zehe (:MarcoZ) 2011-04-12 03:20:57 PDT
The try-server build here:
http://ftp.mozilla.org/pub/mozilla.org/firefox/tryserver-builds/surkov.alexander@gmail.com-4546f104f670/tryserver-win32/
fixes this bug. So the patch that landed seems to be good. Will confirm with nightly build as soon as it's ready.
Comment 13 Marco Zehe (:MarcoZ) 2011-04-13 05:29:32 PDT
Verified fixed in Mozilla/5.0 (Windows NT 6.1; WOW64; rv:5.0a2) Gecko/20110412 Firefox/5.0a2
Comment 14 Marco Zehe (:MarcoZ) 2011-04-14 08:34:56 PDT
Backed out of Aurora in the wake of the bug 634218 backout:
http://hg.mozilla.org/mozilla-aurora/rev/bcc0d10b5d4b
Comment 15 Marco Zehe (:MarcoZ) 2011-04-14 09:11:36 PDT
Sorry for the spam, the correct link of the backout changeset on Aurora is:
http://hg.mozilla.org/mozilla-aurora/rev/25feb8bd6294

Note You need to log in before you can comment on or make changes to this bug.