Crash [@ RelatedAccIterator::RelatedAccIterator(nsDocAccessible*, nsIContent*, nsIAtom*) ]

RESOLVED FIXED in mozilla8

Status

()

Core
Disability Access APIs
--
critical
RESOLVED FIXED
6 years ago
6 years ago

People

(Reporter: MarcoZ, Assigned: tbsaunde)

Tracking

({crash, regression})

Trunk
mozilla8
x86_64
Windows 7
crash, regression
Points:
---

Firefox Tracking Flags

(Not tracked)

Details

(crash signature)

Attachments

(1 attachment, 1 obsolete attachment)

(Reporter)

Description

6 years ago
First appears in the August 11, 2011 nightly build and is a regression from bug 641838 (the AccessibleRelation dexpcom refactor).

I can reproduce this at will by:
1. with NVDA running, starting the Nightly.
2. Pressing Ctrl+L to go to the Location bar.
3. Starting to type something like about:buildconfig. After one, two letters, probably as soon as the list appears, I get a crash.

Report: https://crash-stats.mozilla.com/report/index/bp-a152e4e3-ebb8-4328-8e23-c42a72110811
(Reporter)

Updated

6 years ago
Crash Signature: [@ RelatedAccIterator::RelatedAccIterator(nsDocAccessible*, nsIContent*, nsIAtom*) ] → RelatedAccIterator::RelatedAccIterator(nsDocAccessible*, nsIContent*, nsIAtom*)
(Assignee)

Comment 1

6 years ago
Created attachment 552482 [details] [diff] [review]
a thought

aI'm a little skeptical this is the issue Marco had based on the stack, but that stack isn't really good enough to denie anything, and I'm pretty sure we want this patch anyway

so, which ever of you gets to it first or both of you if you like :)
Attachment #552482 - Flags: review?(surkov.alexander)
Attachment #552482 - Flags: review?(bolterbugz)
Comment on attachment 552482 [details] [diff] [review]
a thought

r=me (code inspection only)
Attachment #552482 - Flags: review?(bolterbugz) → review+
(Assignee)

Comment 3

6 years ago
try builds for that patch should show up at http://ftp.mozilla.org/pub/mozilla.org/firefox/try-builds/trev.saunders@gmail.com-66a378ab0860.

Comment 4

6 years ago
Comment on attachment 552482 [details] [diff] [review]
a thought

yes, this is right. Until we have good stack this is reasonable guess because IsDefunct() check was got rid.
Attachment #552482 - Flags: review?(surkov.alexander) → review+

Comment 5

6 years ago
Comment on attachment 552482 [details] [diff] [review]
a thought


>   VariantInit(pvarEndUpAt);
>+  nsAccessible *xpAccessibleStart = GetXPAccessibleFor(varStart);
>+  if (!xpAccessibleStart || IsDefunct())
>+    return E_FAIL;
> 

initialize variant after you are use in correct accessible

Updated

6 years ago
Assignee: nobody → trev.saunders
(Assignee)

Comment 6

6 years ago
Created attachment 552554 [details] [diff] [review]
patch to land

is this the whitespace you want around variant_init()?
Attachment #552482 - Attachment is obsolete: true
(Assignee)

Comment 7

6 years ago
landed on http://hg.mozilla.org/integration/mozilla-inbound/rev/febd4e26179c
(Reporter)

Comment 8

6 years ago
From my testing the try-server build, it appears that this bug fixes the crash.
https://hg.mozilla.org/mozilla-central/rev/febd4e26179c
Status: NEW → RESOLVED
Last Resolved: 6 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla8
Crash Signature: RelatedAccIterator::RelatedAccIterator(nsDocAccessible*, nsIContent*, nsIAtom*) → [@ RelatedAccIterator::RelatedAccIterator(nsDocAccessible*, nsIContent*, nsIAtom*) ]
You need to log in before you can comment on or make changes to this bug.