Last Comment Bug 678189 - Crash [@ RelatedAccIterator::RelatedAccIterator(nsDocAccessible*, nsIContent*, nsIAtom*) ]
: Crash [@ RelatedAccIterator::RelatedAccIterator(nsDocAccessible*, nsIContent*...
: crash, regression
Product: Core
Classification: Components
Component: Disability Access APIs (show other bugs)
: Trunk
: x86_64 Windows 7
-- critical (vote)
: mozilla8
Assigned To: Trevor Saunders (:tbsaunde)
: alexander :surkov
Depends on:
Blocks: 641838
  Show dependency treegraph
Reported: 2011-08-11 07:17 PDT by Marco Zehe (:MarcoZ)
Modified: 2011-08-12 14:13 PDT (History)
7 users (show)
See Also:
Crash Signature:
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---

a thought (987 bytes, patch)
2011-08-11 13:09 PDT, Trevor Saunders (:tbsaunde)
dbolter: review+
surkov.alexander: review+
Details | Diff | Splinter Review
patch to land (783 bytes, patch)
2011-08-11 17:28 PDT, Trevor Saunders (:tbsaunde)
no flags Details | Diff | Splinter Review

Description User image Marco Zehe (:MarcoZ) 2011-08-11 07:17:24 PDT
First appears in the August 11, 2011 nightly build and is a regression from bug 641838 (the AccessibleRelation dexpcom refactor).

I can reproduce this at will by:
1. with NVDA running, starting the Nightly.
2. Pressing Ctrl+L to go to the Location bar.
3. Starting to type something like about:buildconfig. After one, two letters, probably as soon as the list appears, I get a crash.

Comment 1 User image Trevor Saunders (:tbsaunde) 2011-08-11 13:09:56 PDT
Created attachment 552482 [details] [diff] [review]
a thought

aI'm a little skeptical this is the issue Marco had based on the stack, but that stack isn't really good enough to denie anything, and I'm pretty sure we want this patch anyway

so, which ever of you gets to it first or both of you if you like :)
Comment 2 User image David Bolter [:davidb] 2011-08-11 13:12:11 PDT
Comment on attachment 552482 [details] [diff] [review]
a thought

r=me (code inspection only)
Comment 3 User image Trevor Saunders (:tbsaunde) 2011-08-11 15:43:05 PDT
try builds for that patch should show up at
Comment 4 User image alexander :surkov 2011-08-11 17:12:58 PDT
Comment on attachment 552482 [details] [diff] [review]
a thought

yes, this is right. Until we have good stack this is reasonable guess because IsDefunct() check was got rid.
Comment 5 User image alexander :surkov 2011-08-11 17:14:15 PDT
Comment on attachment 552482 [details] [diff] [review]
a thought

>   VariantInit(pvarEndUpAt);
>+  nsAccessible *xpAccessibleStart = GetXPAccessibleFor(varStart);
>+  if (!xpAccessibleStart || IsDefunct())
>+    return E_FAIL;

initialize variant after you are use in correct accessible
Comment 6 User image Trevor Saunders (:tbsaunde) 2011-08-11 17:28:50 PDT
Created attachment 552554 [details] [diff] [review]
patch to land

is this the whitespace you want around variant_init()?
Comment 7 User image Trevor Saunders (:tbsaunde) 2011-08-11 17:50:42 PDT
landed on
Comment 8 User image Marco Zehe (:MarcoZ) 2011-08-11 21:06:24 PDT
From my testing the try-server build, it appears that this bug fixes the crash.
Comment 9 User image Matt Brubeck (:mbrubeck) 2011-08-12 07:21:23 PDT

Note You need to log in before you can comment on or make changes to this bug.