857334 - crash in mozilla::a11y::XULTextFieldAccessible::FrameSelection

Status: RESOLVED FIXED

(Core :: Disability Access APIs, defect)

Description

[Wayne Mery (:wsmwk)]

This bug was filed from the Socorro interface and is 
report bp-ed693f70-c819-46a2-a97a-d64872130328 .
============================================================= 
0 	xul.dll 	mozilla::a11y::XULTextFieldAccessible::FrameSelection 	accessible/src/xul/XULFormControlAccessible.cpp:847
1 	xul.dll 	HyperTextAccessible::GetCaretOffset 	accessible/src/generic/HyperTextAccessible.cpp:1587
2 	xul.dll 	nsCaretAccessible::NormalSelectionChanged 	accessible/src/base/nsCaretAccessible.cpp:235
3 	xul.dll 	nsCaretAccessible::ProcessSelectionChanged 	accessible/src/base/nsCaretAccessible.cpp:211
4 	xul.dll 	NotificationController::HandleNotification<nsCaretAccessible,nsISelection> 	accessible/src/base/NotificationController.h:143
5 	xul.dll 	nsCaretAccessible::NotifySelectionChanged 	accessible/src/base/nsCaretAccessible.cpp:196
6 	xul.dll 	mozilla::Selection::NotifySelectionListeners 	layout/generic/nsSelection.cpp:5413
7 	xul.dll 	nsFrameSelection::NotifySelectionListeners 	layout/generic/nsSelection.cpp:2037
8 	xul.dll 	nsFrameSelection::SetMouseDownState 	layout/generic/nsSelection.cpp:1697
9 	xul.dll 	nsFrame::HandleRelease 	layout/generic/nsFrame.cpp:3146
10 	xul.dll 	nsFrame::HandleEvent 	layout/generic/nsFrame.cpp:2378
11 	xul.dll 	nsPresShellEventCB::HandleEvent 	layout/base/nsPresShell.cpp:505
12 	xul.dll 	nsEventTargetChainItem::HandleEventTargetChain 	content/events/src/nsEventDispatcher.cpp:363

Comment 1

[Trevor Saunders (:tbsaunde)]

My guess is that GetInput() is returning null for some reason but I have no idea why

Comment 2

[alexander :surkov (:asurkov)]

(In reply to Trevor Saunders (:tbsaunde) from comment #1)
> My guess is that GetInput() is returning null for some reason but I have no
> idea why

same, null check + assertion = hoping we will catch it one day

Comment 3

[MikeLing]

Hi I am interested in working on this bug,but it's my first time to work on with debug,can anybody guide me on how to get started with it?Thanks a lot.

Comment 4

[Wayne Mery (:wsmwk)]

(In reply to MikeLing from comment #3)
> Hi I am interested in working on this bug,but it's my first time to work on
> with debug,can anybody guide me on how to get started with it?Thanks a lot.

Comment 5

[Anand Soni]

Hi tbsaunde,

I would like to know more about this bug and how can I go about fixing it. Can you get me started here?

Comment 6

[Trevor Saunders (:tbsaunde)]

(In reply to Anand Soni from comment #5)
> Hi tbsaunde,
> 
> I would like to know more about this bug and how can I go about fixing it.
> Can you get me started here?

In XULTextFieldAccessible::FrameSelection() you need to check if GetInput() returned null and return null before getting the frame if it did.

Comment 7

[poiru]

Attachment: First patch

Comment 8

[poiru]

(In reply to Trevor Saunders (:tbsaunde) from comment #6)
> In XULTextFieldAccessible::FrameSelection() you need to check if GetInput()
> returned null and return null before getting the frame if it did.

Hi. I attached a patch to do exactly this. I also added an assertion as per comment #2.

Comment 9

[Marco Zehe (:MarcoZ)]

Pushed to inbound: https://hg.mozilla.org/integration/mozilla-inbound/rev/df3ad1eb9ebb

Thanks for the patch!

Comment 10

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/df3ad1eb9ebb