803873 - startup crash in DocAccessible::Attributes

Status: RESOLVED FIXED

(Core :: Disability Access APIs, defect)

Description

[Scoobidiver (away)]

It first appeared in 19.0a1/20121020. The regression range is:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=0ff60bfb3442&tochange=ff4af83233dc
It's likely a regression from bug 740764.

Signature 	mozilla::a11y::aria::AttrIterator::AttrIterator(nsIContent*) More Reports Search
UUID	e894d297-0837-4872-b6ec-c69522121020
Date Processed	2012-10-20 16:00:27
Uptime	1
Last Crash	31 seconds before submission
Install Age	17.5 minutes since version was first installed.
Install Time	2012-10-20 15:42:44
Product	Firefox
Version	19.0a1
Build ID	20121020030554
Release Channel	nightly
OS	Windows NT
OS Version	6.1.7601 Service Pack 1
Build Architecture	x86
Build Architecture Info	GenuineIntel family 6 model 42 stepping 7
Crash Reason	EXCEPTION_ACCESS_VIOLATION_READ
Crash Address	0x0
App Notes 	
AdapterVendorID: 0x1002, AdapterDeviceID: 0x6759, AdapterSubsysID: 00000000, AdapterDriverVersion: 8.960.11.1000
Processor Notes 	WARNING: JSON file missing Add-ons
EMCheckCompatibility	True
Adapter Vendor ID	0x1002
Adapter Device ID	0x6759
Total Virtual Memory	2147352576
Available Virtual Memory	1884823552
System Memory Use Percentage	61
Available Page File	3431641088
Available Physical Memory	1229934592
Accessibility	Active

Frame 	Module 	Signature 	Source
0 	xul.dll 	mozilla::a11y::aria::AttrIterator::AttrIterator 	accessible/src/base/nsARIAMap.h:239
1 	xul.dll 	DocAccessible::Attributes 	accessible/src/generic/DocAccessible.cpp:354
2 	xul.dll 	AccessibleWrap::get_attributes 	accessible/src/msaa/AccessibleWrap.cpp:1443
3 	jhook.dll 	jhook.dll@0x24f57 	
4 	jhook.dll 	jhook.dll@0x23f51 	
5 	jhook.dll 	jhook.dll@0x123ac 	
6 	jhook.dll 	jhook.dll@0x13065 	
7 	jhook.dll 	jhook.dll@0x2604 	
8 	jhook.dll 	jhook.dll@0x1c251 	
9 	jhook.dll 	jhook.dll@0x1e8fc 	
10 	user32.dll 	__ClientCallWinEventProc 	
11 	ntdll.dll 	KiUserCallbackDispatcher 	
12 	ntdll.dll 	KiUserApcDispatcher 	
13 	user32.dll 	RealDefWindowProcW 	
14 	user32.dll 	DefWindowProcW 	
15 	user32.dll 	InternalCallWinProc 	
16 	user32.dll 	UserCallWinProcCheckWow 	
17 	user32.dll 	CallWindowProcAorW 	
18 	user32.dll 	CallWindowProcW 	
19 	xul.dll 	nsWindow::WindowProcInternal 	widget/windows/nsWindow.cpp:4370
20 	xul.dll 	CallWindowProcCrashProtected 	xpcom/base/nsCrashOnException.cpp:32
21 	xul.dll 	nsWindow::WindowProc 	widget/windows/nsWindow.cpp:4311
22 	user32.dll 	InternalCallWinProc 	
23 	user32.dll 	UserCallWinProcCheckWow 	
24 	user32.dll 	DispatchClientMessage 	
25 	user32.dll 	__fnDWORD 	
26 	ntdll.dll 	KiUserCallbackDispatcher 	
27 	ntdll.dll 	KiUserApcDispatcher 	
28 	xul.dll 	nsXULWindow::SetVisibility 	xpfe/appshell/src/nsXULWindow.cpp:795
29 	xul.dll 	nsXULWindow::OnChromeLoaded 	xpfe/appshell/src/nsXULWindow.cpp:992
30 	xul.dll 	nsWebShellWindow::OnStateChange 	xpfe/appshell/src/nsWebShellWindow.cpp:563
31 	xul.dll 	nsDocLoader::DoFireOnStateChange 	uriloader/base/nsDocLoader.cpp:1351
32 	xul.dll 	nsDocLoader::doStopDocumentLoad 	uriloader/base/nsDocLoader.cpp:942
33 	xul.dll 	nsDocLoader::DocLoaderIsEmpty 	uriloader/base/nsDocLoader.cpp:820
34 	xul.dll 	nsDocLoader::OnStopRequest 	uriloader/base/nsDocLoader.cpp:704
35 	xul.dll 	nsLoadGroup::RemoveRequest 	netwerk/base/src/nsLoadGroup.cpp:698
36 	xul.dll 	nsDocument::DoUnblockOnload 	content/base/src/nsDocument.cpp:7139
37 	xul.dll 	nsDocument::UnblockOnload 	content/base/src/nsDocument.cpp:7081
38 	xul.dll 	nsBindingManager::DoProcessAttachedQueue 	content/xbl/src/nsBindingManager.cpp:995
39 	xul.dll 	nsRunnableMethodImpl<void 	obj-firefox/dist/include/nsThreadUtils.h:349
...

More reports at:
https://crash-stats.mozilla.com/report/list?signature=mozilla%3A%3Aa11y%3A%3Aaria%3A%3AAttrIterator%3A%3AAttrIterator%28nsIContent*%29
https://crash-stats.mozilla.com/report/list?signature=DocAccessible%3A%3AAttributes%28%29

Comment 1

[alexander :surkov (:asurkov)]

Attachment: patch

Comment 2

[Trevor Saunders (:tbsaunde)]

Comment on attachment 673648 [details] [diff] [review]
patch

>-  if (!mParent)
>+  // No attributes if document is not attached to the tree or if it's a root
>+  // document.
>+  if (!mParent || !mParent->HasOwnContent())

I think I'd do !mParent || IsRootAccessible()

which seems a little clearer that the case you avoid is root accessible whose parent is the Application accessible with no content.  I think that's also a little faster since you don't need to inspect members of mParent.

Comment 3

[alexander :surkov (:asurkov)]

landed with Trev comment addressed
http://hg.mozilla.org/integration/mozilla-inbound/rev/1ebb05c8a8c8

Comment 4

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/1ebb05c8a8c8