crash in nsXULTreeAccessible::Value

VERIFIED FIXED in mozilla15

Status

()

Core
Disability Access APIs
--
critical
VERIFIED FIXED
5 years ago
5 years ago

People

(Reporter: MarcoZ, Assigned: capella)

Tracking

({crash})

Other Branch
mozilla15
x86
Windows NT
crash
Points:
---
Bug Flags:
in-testsuite ?

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: [good first bug][mentor=trev.saunders@gmail.com][lang=c++][gs][gssolved], crash signature, URL)

Attachments

(1 attachment)

(Reporter)

Description

5 years ago
This bug was filed from the Socorro interface and is 
report bp-c7d007a9-42bd-48eb-96a7-0695d2120419 .
============================================================= 
I did the following:
1. Opened Thunderbird.
2. Opened the IM module and logged on to a few IRC channels.
3. Right-clicked one of the IRC channels and selected "Close this conversation".

Note that I had right-clicked the "Nickserv" message conversation before and closed it without incident, so this may not be reproducible at will.
It looks like the accessible is alive (probably in doc cache) but has been shutdown, leaving mTreeView nulled out. Meanwhile NVDA is asking for a value and kaboom.

Comment 2

5 years ago
(In reply to David Bolter [:davidb] from comment #1)
> It looks like the accessible is alive (probably in doc cache) but has been
> shutdown,

nope

> leaving mTreeView nulled out.

yes
How is mTreeView nulled out?
(In reply to David Bolter [:davidb] from comment #3)
> How is mTreeView nulled out?

TreViewChanged(), I think the right fix here is just adding a null check.
If the tree view changes, shouldn't we destroy the accessible and create a new one?
When do tree views change?

Comment 7

5 years ago
(In reply to David Bolter [:davidb] from comment #5)
> If the tree view changes, shouldn't we destroy the accessible and create a
> new one?

tree accessible? nope, 'cause treeview is responsible for data, i.e rows

(In reply to David Bolter [:davidb] from comment #6)
> When do tree views change?

when the author changes the tree view.

Comment 8

5 years ago
per comment #4, add a mTreeView null check into Value() method
Whiteboard: [good first bug][mentor=trev.saunders@gmail.com][lang=c++]
Target Milestone: --- → mozilla14
Version: Trunk → Other Branch

Updated

5 years ago
Target Milestone: mozilla14 → ---
(In reply to alexander :surkov from comment #7)
> (In reply to David Bolter [:davidb] from comment #6)
> > When do tree views change?
> 
> when the author changes the tree view.

Heh, I was wondering more about when and how often. I suspect this happens more in tbird.

OK I think I know where this bugs going :)

Comment 10

5 years ago
(In reply to David Bolter [:davidb] from comment #9)
> Heh, I was wondering more about when and how often. I suspect this happens
> more in tbird.

sort of strange question because that depends on the author (application) completely. Basically when the tree gets into no-data state then I think the author nulls out the treeview. 

I would suspect that too because tbird UI uses XUL trees a lot.

> OK I think I know where this bugs going :)

where? :)
(Assignee)

Comment 11

5 years ago
Created attachment 618877 [details] [diff] [review]
Patch (v1)

Quick fix for a "red" bug ... built and tested locally ...
Assignee: nobody → markcapella
Status: NEW → ASSIGNED
Attachment #618877 - Flags: review?(trev.saunders)
(Assignee)

Updated

5 years ago
Attachment #618877 - Flags: review?(trev.saunders) → review?(surkov.alexander)

Comment 12

5 years ago
Comment on attachment 618877 [details] [diff] [review]
Patch (v1)

thanks for doing this
Attachment #618877 - Flags: review?(surkov.alexander) → review+

Comment 13

5 years ago
https://hg.mozilla.org/integration/mozilla-inbound/rev/bba6161714f2
Target Milestone: --- → mozilla15
http://hg.mozilla.org/mozilla-central/rev/bba6161714f2
Status: ASSIGNED → RESOLVED
Last Resolved: 5 years ago
Flags: in-testsuite?
Resolution: --- → FIXED
reporter in https://getsatisfaction.com/mozilla_messaging/tags/bug_746990 indicates crash is fixed for thunderbird 15
Status: RESOLVED → VERIFIED
Whiteboard: [good first bug][mentor=trev.saunders@gmail.com][lang=c++] → [good first bug][mentor=trev.saunders@gmail.com][lang=c++][gs][gssolved]
You need to log in before you can comment on or make changes to this bug.