crash nsDocAccessible::GetNativeWindow

RESOLVED FIXED in mozilla12

Status

()

Core
Disability Access APIs
--
critical
RESOLVED FIXED
6 years ago
6 years ago

People

(Reporter: davidb, Assigned: davidb)

Tracking

({crash})

unspecified
mozilla12
x86
Windows 7
crash
Points:
---

Firefox Tracking Flags

(Not tracked)

Details

(crash signature)

Attachments

(1 attachment)

Created attachment 587030 [details] [diff] [review]
trivial fix

E.g.
report bp-e1a04182-b727-43d4-80cd-f4b8b2120107
Attachment #587030 - Flags: review?(trev.saunders)
Comment on attachment 587030 [details] [diff] [review]
trivial fix

r=me, but please change to an early bail out instead of adding another if wrapping the whole thing.
Attachment #587030 - Flags: review?(trev.saunders) → review+
Do you know why the accessible itself has a pres shell, but the doc doesn't as seen from the NS_ENSURE_TRUE in FireEvent()?  I'm sort of worried there might be something deeper here.

it occurs to me the jaws hack checks the role of the target without making sure it isn't defunct, but the odds that will actually cause a crash seems pretty low since you'd have to focus the event and then shut it down in the same  refresh driver cycle.

also, the #ifdef DEBUG should cover a little more in that function than it already does for future cleanup.
(In reply to Trevor Saunders (:tbsaunde) from comment #1)
> Comment on attachment 587030 [details] [diff] [review]
> trivial fix
> 
> r=me, but please change to an early bail out instead of adding another if
> wrapping the whole thing.

We have examples of both. I looked before I did it this way. I usually do bail outs if the method is longer. /me shrugs.
BTW, thanks for the review and I can make that change.

I'm not sure what you mean about the jaws hack in comment 2 (yet).
http://hg.mozilla.org/integration/mozilla-inbound/rev/1ed2eb54e546
Status: NEW → RESOLVED
Last Resolved: 6 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla12
(In reply to Trevor Saunders (:tbsaunde) from comment #2)
> Do you know why the accessible itself has a pres shell, but the doc doesn't
> as seen from the NS_ENSURE_TRUE in FireEvent()?  I'm sort of worried there
> might be something deeper here.
> 
> it occurs to me the jaws hack checks the role of the target without making
> sure it isn't defunct, but the odds that will actually cause a crash seems
> pretty low since you'd have to focus the event and then shut it down in the
> same  refresh driver cycle.
> 
> also, the #ifdef DEBUG should cover a little more in that function than it
> already does for future cleanup.

Please file spin-off bugs if you think we should take action on these concerns.

Comment 7

6 years ago
https://hg.mozilla.org/mozilla-central/rev/1ed2eb54e546
You need to log in before you can comment on or make changes to this bug.