807642 - Crash when opening tabs

Status: RESOLVED DUPLICATE of bug 807596

(Core :: Disability Access APIs, defect)

Description

[Hubert Figuiere [:hub]]

I rebuilt by Firefox, restarted it with my profile, and when I opened a new link it crashed.

Not sure exactly but I also had some tab to the intranet asking for a password.

It does not reproduce with my test profile.

Here is the stack trace:

#0  Accessible::GetActionRule (this=0x7fffbd6c6520) at /home/hub/source/mozilla/src/accessible/src/generic/Accessible.cpp:3095
#1  0x00007ffff4e9d05d in Accessible::ActionCount (this=<optimized out>) at /home/hub/source/mozilla/src/accessible/src/generic/Accessible.cpp:1764
#2  0x00007ffff4eb70d7 in AccessibleWrap::CreateMaiInterfaces (this=this@entry=0x7fffbd6c6520)
    at /home/hub/source/mozilla/src/accessible/src/atk/AccessibleWrap.cpp:376
#3  0x00007ffff4eb7380 in AccessibleWrap::GetNativeInterface (this=0x7fffbd6c6520, aOutAccessible=0x7fffffffb518)
    at /home/hub/source/mozilla/src/accessible/src/atk/AccessibleWrap.cpp:332
#4  0x00007ffff4eb709f in AccessibleWrap::GetAtkObject (acc=acc@entry=0x7fffbd6c6540)
    at /home/hub/source/mozilla/src/accessible/src/atk/AccessibleWrap.cpp:362
#5  0x00007ffff4eb8484 in AccessibleWrap::FirePlatformEvent (this=0x7fffbd6c6520, aEvent=0x7fffdcbdbdc0)
    at /home/hub/source/mozilla/src/accessible/src/atk/AccessibleWrap.cpp:969
#6  0x00007ffff4e94603 in nsEventShell::FireEvent (aEvent=0x7fffdcbdbdc0) at /home/hub/source/mozilla/src/accessible/src/base/nsEventShell.cpp:29
#7  0x00007ffff4ea4a8c in DocAccessible::ProcessPendingEvent (this=0x7fffbd6c6520, aEvent=0x7fffdcbdbdc0)
    at /home/hub/source/mozilla/src/accessible/src/generic/DocAccessible.cpp:1804
#8  0x00007ffff4e8b0e7 in NotificationController::WillRefresh (this=0x7fffbd2ce080, aTime=...)
    at /home/hub/source/mozilla/src/accessible/src/base/NotificationController.cpp:327
#9  0x00007ffff46b397a in nsRefreshDriver::Notify (this=0x7fffbd826c00, aTimer=<optimized out>)
    at /home/hub/source/mozilla/src/layout/base/nsRefreshDriver.cpp:344
#10 0x00007ffff503fadb in nsTimerImpl::Fire (this=this@entry=0x7fffbd63f6a0) at /home/hub/source/mozilla/src/xpcom/threads/nsTimerImpl.cpp:485
#11 0x00007ffff503fbb5 in nsTimerEvent::Run (this=<optimized out>) at /home/hub/source/mozilla/src/xpcom/threads/nsTimerImpl.cpp:565
#12 0x00007ffff503c9d3 in nsThread::ProcessNextEvent (this=0x7ffff7d24ac0, mayWait=<optimized out>, result=0x7fffffffb94f)
    at /home/hub/source/mozilla/src/xpcom/threads/nsThread.cpp:627
#13 0x00007ffff50109ff in NS_ProcessNextEvent_P (thread=<optimized out>, mayWait=false)
    at /home/hub/source/mozilla/src/obj-x86_64-unknown-linux-gnu/xpcom/build/nsThreadUtils.cpp:221
#14 0x00007ffff4f21297 in mozilla::ipc::MessagePump::Run (this=0x7fffec734280, aDelegate=0x7ffff7ddae60)
    at /home/hub/source/mozilla/src/ipc/glue/MessagePump.cpp:82
#15 0x00007ffff505edbe in RunHandler (this=0x7ffff7ddae60) at /home/hub/source/mozilla/src/ipc/chromium/src/base/message_loop.cc:208
#16 MessageLoop::Run (this=0x7ffff7ddae60) at /home/hub/source/mozilla/src/ipc/chromium/src/base/message_loop.cc:182
#17 0x00007ffff4e705a1 in nsBaseAppShell::Run (this=0x7fffeabc24e0) at /home/hub/source/mozilla/src/widget/xpwidgets/nsBaseAppShell.cpp:163
#18 0x00007ffff4d44e40 in nsAppStartup::Run (this=0x7fffeabd17e0) at /home/hub/source/mozilla/src/toolkit/components/startup/nsAppStartup.cpp:290
#19 0x00007ffff44c9cd6 in XREMain::XRE_mainRun (this=this@entry=0x7fffffffbbb8) at /home/hub/source/mozilla/src/toolkit/xre/nsAppRunner.cpp:3818

I also have a fix that prevent the crash that I will attach.

This is on Linux, and a11y is enabled by default.

Comment 1

[Hubert Figuiere [:hub]]

Attachment: Make sure that mContent isn't null. r=

Comment 2

[David Bolter [:davidb] (NeedInfo me for attention)]

Hmmm maybe we should do this in FirePlatform event like we do for msaa:
NS_ENSURE_TRUE(!IsDefunct(), NS_ERROR_FAILURE);

But I'm not sure if the existing is equiv:
 AccessibleWrap* accWrap = GetAccessibleWrap(atkObj);
...
   if (!accWrap) {
     return NS_OK; // Node is shut down
   }

Comment 3

[Hubert Figuiere [:hub]]

Comment on attachment 677385 [details] [diff] [review]
Make sure that mContent isn't null. r=

Trevor, what do you think?

Comment 4

[David Bolter [:davidb] (NeedInfo me for attention)]

Hmmm actually IsDefunct is probably not what you want. /me distracted