753253 - crash in nsAccessible::ScrollTo

Status: RESOLVED FIXED

(Core :: Disability Access APIs, defect)

Description

[Scoobidiver (away)]

There's one crash in 15.0a1/20120508.
It's probably related to bug 753093.

Signature 	nsAccessible::ScrollTo More Reports Search
UUID	10439dc9-636a-4480-aea6-811f32120508
Date Processed	2012-05-08 21:30:13
Uptime	175
Install Age	2.9 minutes since version was first installed.
Install Time	2012-05-08 21:27:01
Product	FennecAndroid
Version	15.0a1
Build ID	20120508055912
Release Channel	nightly
OS	Linux
OS Version	0.0.0 Linux 3.0.8-gda6252b #1 SMP PREEMPT Fri Apr 13 11:35:09 PDT 2012 armv7l
Build Architecture	arm
Build Architecture Info	
Crash Reason	SIGSEGV
Crash Address	0x100
App Notes 	
AdapterVendorID: tuna, AdapterDeviceID: Galaxy Nexus.
AdapterDescription: 'Model: 'Galaxy Nexus', Product: 'yakju', Manufacturer: 'samsung', Hardware: 'tuna''.
samsung Galaxy Nexus
google/yakju/maguro:4.0.4/IMM76I/330937:user/release-keys
Processor Notes 	This dump is too long and has triggered the automatic truncation routine
EMCheckCompatibility	True

Frame 	Module 	Signature 	Source
0 	libxul.so 	nsAccessible::ScrollTo 	accessible/src/base/nsAccessible.cpp:2241
1 	libxul.so 	NS_InvokeByIndex_P 	xpcom/reflect/xptcall/src/md/unix/xptcinvoke_arm.cpp:194
2 	libxul.so 	XPCWrappedNative::CallMethod 	js/xpconnect/src/XPCWrappedNative.cpp:3102
3 	libxul.so 	XPC_WN_CallMethod 	js/xpconnect/src/XPCWrappedNativeJSOps.cpp:1541
4 	libxul.so 	js::Interpret 	js/src/jscntxtinlines.h:426
5 	libxul.so 	js::RunScript 	js/src/jsinterp.cpp:480
6 	libxul.so 	js::Invoke 	js/src/jsinterp.cpp:540
7 	libxul.so 	js::ProxyHandler::call 	js/src/jsproxy.cpp:340
8 	libxul.so 	js::Wrapper::call 	js/src/jswrapper.cpp:276
9 	libxul.so 	js::CrossCompartmentWrapper::call 	js/src/jswrapper.cpp:758
10 	libxul.so 	proxy_Call 	js/src/jsproxy.cpp:911
11 	libxul.so 	js::Interpret 	js/src/jscntxtinlines.h:426
12 	libxul.so 	js::RunScript 	js/src/jsinterp.cpp:480
13 	libxul.so 	js::InvokeKernel 	js/src/jsinterp.cpp:540
14 	libxul.so 	array_forEach 	js/src/jsinterp.h:172
15 	libxul.so 	js::Interpret 	js/src/jscntxtinlines.h:426
16 	libxul.so 	js::RunScript 	js/src/jsinterp.cpp:480
17 	libxul.so 	js::Invoke 	js/src/jsinterp.cpp:540
18 	libxul.so 	JS_CallFunctionValue 	js/src/jsapi.cpp:5429
19 	libxul.so 	nsXPCWrappedJSClass::CallMethod 	js/xpconnect/src/XPCWrappedJSClass.cpp:1509
20 	libxul.so 	nsXPCWrappedJS::CallMethod 	js/xpconnect/src/XPCWrappedJS.cpp:616
21 	libxul.so 	PrepareAndDispatch 	xpcom/reflect/xptcall/src/md/unix/xptcstubs_arm.cpp:138
...

More reports at:
https://crash-stats.mozilla.com/report/list?signature=nsAccessible%3A%3AScrollTo

Comment 1

[Trevor Saunders (:tbsaunde)]

similar, but different, ScrollTo() is missing a IsDefunct() check.

Comment 2

[Marco Zehe (:MarcoZ)]

Attachment: IsDefunct check for nsAccessible::ScrollTo

Trevor, you mean like this?

Comment 3

[Trevor Saunders (:tbsaunde)]

Comment on attachment 622353 [details] [diff] [review]
IsDefunct check for nsAccessible::ScrollTo

it feels a bit like reviewing a patch I wrote, but r=me

Comment 4

[Marco Zehe (:MarcoZ)]

Landed: http://hg.mozilla.org/integration/mozilla-inbound/rev/7abd49ddaf73

Comment 5

[Ed Morley [:emorley]]

https://hg.mozilla.org/mozilla-central/rev/7abd49ddaf73