740958 - crash in nsAccessible::GetBounds

Status: RESOLVED FIXED

(Core :: Disability Access APIs, defect)

Description

[Scoobidiver (away)]

It first appeared in 14.0a1/20120330. The regression range is:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=1965a2c89d61&tochange=92fe907ddac8
It's likely caused by bug 737724.

It's similar to bug 729861.

Signature 	nsAccessible::GetBounds(int*, int*, int*, int*) More Reports Search
UUID	bc5f9bab-0d90-4f5a-91a6-dbda02120330
Date Processed	2012-03-30 15:49:33
Uptime	24
Last Crash	2.7 minutes before submission
Install Age	1.7 hours since version was first installed.
Install Time	2012-03-30 14:08:06
Product	Firefox
Version	14.0a1
Build ID	20120330031146
Release Channel	nightly
OS	Windows NT
OS Version	6.1.7601 Service Pack 1
Build Architecture	x86
Build Architecture Info	GenuineIntel family 6 model 23 stepping 6
Crash Reason	EXCEPTION_ACCESS_VIOLATION_READ
Crash Address	0x134
App Notes 	
AdapterVendorID: 0x10de, AdapterDeviceID: 0x1244, AdapterSubsysID: 20593842, AdapterDriverVersion: 8.17.12.9610
D2D? D2D+ DWrite? DWrite+ D3D10 Layers? D3D10 Layers+ 
EMCheckCompatibility	True	
Total Virtual Memory	4294836224
Available Virtual Memory	3821731840
System Memory Use Percentage	25
Available Page File	30201778176
Available Physical Memory	12753747968

Frame 	Module 	Signature 	Source
0 	xul.dll 	nsAccessible::GetBounds 	accessible/src/base/nsAccessible.cpp:1010
1 	xul.dll 	nsAccessible::ChildAtPoint 	accessible/src/base/nsAccessible.cpp:841
2 	xul.dll 	nsAccessibleWrap::accHitTest 	accessible/src/msaa/nsAccessibleWrap.cpp:890
3 	rpcrt4.dll 	Invoke 	
4 	rpcrt4.dll 	NdrStubCall2 	
5 	ole32.dll 	NdrpCreateStub 	
6 	oleaut32.dll 	CUnivStubWrapper::Invoke 	
7 	ole32.dll 	SyncStubInvoke 	
8 	ole32.dll 	StubInvoke 	
9 	ole32.dll 	CCtxComChnl::ContextInvoke 	
10 	ole32.dll 	MTAInvoke 	
11 	ole32.dll 	STAInvoke 	
12 	ole32.dll 	AppInvoke 	
13 	ole32.dll 	ComInvokeWithLockAndIPID 	
14 	ole32.dll 	ComInvoke 	
15 	ole32.dll 	ThreadDispatch 	
16 	ole32.dll 	ThreadWndProc 	
17 	user32.dll 	InternalCallWinProc 	
18 	user32.dll 	UserCallWinProcCheckWow 	
19 	user32.dll 	DispatchMessageWorker 	
20 	user32.dll 	DispatchMessageW 	
21 	xul.dll 	nsAppShell::ProcessNextNativeEvent 	widget/windows/nsAppShell.cpp:351
22 	xul.dll 	nsBaseAppShell::OnProcessNextEvent 	widget/xpwidgets/nsBaseAppShell.cpp:306
23 	xul.dll 	nsThread::ProcessNextEvent 	xpcom/threads/nsThread.cpp:618
24 	xul.dll 	mozilla::ipc::MessagePump::Run 	ipc/glue/MessagePump.cpp:110
25 	xul.dll 	MessageLoop::RunHandler 	ipc/chromium/src/base/message_loop.cc:201
26 	xul.dll 	MessageLoop::Run 	ipc/chromium/src/base/message_loop.cc:175
27 	xul.dll 	nsBaseAppShell::Run 	widget/xpwidgets/nsBaseAppShell.cpp:189
28 	xul.dll 	nsAppShell::Run 	widget/windows/nsAppShell.cpp:267
29 	xul.dll 	nsAppStartup::Run 	toolkit/components/startup/nsAppStartup.cpp:295
30 	xul.dll 	XREMain::XRE_mainRun 	toolkit/xre/nsAppRunner.cpp:3770
31 	xul.dll 	XREMain::XRE_main 	toolkit/xre/nsAppRunner.cpp:3847
32 	xul.dll 	XRE_main 	toolkit/xre/nsAppRunner.cpp:3923
33 	firefox.exe 	wmain 	toolkit/xre/nsWindowsWMain.cpp:107
34 	firefox.exe 	__tmainCRTStartup 	crtexe.c:552
35 	kernel32.dll 	BaseThreadInitThunk 	
36 	ntdll.dll 	__RtlUserThreadStart 	
37 	ntdll.dll 	_RtlUserThreadStart 	

More reports at:
https://crash-stats.mozilla.com/report/list?signature=nsAccessible%3A%3AGetBounds%28int*%2C+int*%2C+int*%2C+int*%29

Comment 1

[alexander :surkov (:asurkov)]

Trevor, ideas?

Comment 2

[Scoobidiver (away)]

There are now two comments:
"Hovering mouse on nightly HELP (pausing to answer someone's question before clicking it"
"wheel-scrolling boktowergardens.org"

Comment 3

[Trevor Saunders (:tbsaunde)]

(In reply to alexander :surkov from comment #1)
> Trevor, ideas?

maybe like bug 741053 but with nsHTMLWin32ObjectAccessible, but I'm not sure we ever let clients have one of those directly, and comment 2 doesn't really support that theory.

Comment 4

[Scoobidiver (away)]

It's #4 top crasher over the last day.

Comment 5

[alexander :surkov (:asurkov)]

Attachment: patch

Trevor's idea

Comment 6

[alexander :surkov (:asurkov)]

https://hg.mozilla.org/mozilla-central/rev/93251eb39b6e

Comment 7

[David Bolter [:davidb] (NeedInfo me for attention)]

So far so good, I don't see any crashes since build 20120402031127.