783383 - crash in nsBaseWidget::GetAccessible

Status: RESOLVED FIXED

(Core :: Disability Access APIs, defect)

Description

[Scoobidiver (away)]

It first appeared in 17.0a1/20120816. The regression range is:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=7d4268f8884c&tochange=50e4ff05741e
It's likely a regression from bug 743975.

Signature 	nsBaseWidget::GetAccessible() More Reports Search
UUID	90181ba8-b252-41f4-b5e3-e2c862120816
Date Processed	2012-08-16 19:53:46
Uptime	3664
Last Crash	1.0 hours before submission
Install Age	3.6 hours since version was first installed.
Install Time	2012-08-16 16:20:07
Product	Firefox
Version	17.0a1
Build ID	20120816030539
Release Channel	nightly
OS	Windows NT
OS Version	6.1.7601 Service Pack 1
Build Architecture	x86
Build Architecture Info	GenuineIntel family 6 model 26 stepping 4
Crash Reason	EXCEPTION_ACCESS_VIOLATION_READ
Crash Address	0x0
App Notes 	
AdapterVendorID: 0x1002, AdapterDeviceID: 0x9440, AdapterSubsysID: 20071787, AdapterDriverVersion: 8.970.100.3000
Processor Notes 	WARNING: JSON file missing Add-ons
EMCheckCompatibility	True
Adapter Vendor ID	0x1002
Adapter Device ID	0x9440
Total Virtual Memory	2147352576
Available Virtual Memory	1788301312
System Memory Use Percentage	78
Available Page File	927268864
Available Physical Memory	701054976

Frame 	Module 	Signature 	Source
0 	xul.dll 	nsBaseWidget::GetAccessible 	widget/xpwidgets/nsBaseWidget.cpp:1388
1 	xul.dll 	nsWindow::GetRootAccessible 	widget/windows/nsWindow.cpp:7361
2 	xul.dll 	nsWindow::ProcessMessage 	widget/windows/nsWindow.cpp:5052
3 	xul.dll 	nsWindow::WindowProcInternal 	widget/windows/nsWindow.cpp:4265
4 	xul.dll 	CallWindowProcCrashProtected 	xpcom/base/nsCrashOnException.cpp:32
5 	xul.dll 	nsWindow::WindowProc 	widget/windows/nsWindow.cpp:4207
...

More reports at:
https://crash-stats.mozilla.com/report/list?signature=nsBaseWidget%3A%3AGetAccessible%28%29
https://crash-stats.mozilla.com/report/list?signature=nsBaseWidget%3A%3AGetAccessible

Comment 1

[Andrew Quartey [:drexler]]

The null check in static nsIPresShell* GetPresShell(nsIWidget* aWidget, void* clientData) was removed by this revision: http://hg.mozilla.org/mozilla-central/rev/4aca82dc0d41. Furthermore, not all places that use mWidgetListener were null-checked thereafter.

Comment 2

[Andrew Quartey [:drexler]]

Attachment: patch

Comment 3

[Trevor Saunders (:tbsaunde)]

Comment on attachment 652605 [details] [diff] [review]
patch

I think tnikkel is enough here.

Comment 4

[Andrew Quartey [:drexler]]

http://hg.mozilla.org/integration/mozilla-inbound/rev/71dce48a6079

Comment 5

[David Bolter [:davidb] (NeedInfo me for attention)]

Thank you!

Comment 6

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/71dce48a6079