Joanmarie Diggs Reporter
	Description • 9 years ago

Steps to reproduce:
1. Import the attached mail message in Thunderbird
2. Quit Thunderbird
3. Launched the attached pyatspi accessible event listener in a terminal
4. Launch Thunderbird
5. Click on the mail folder which holds the imported mail message
6. Hover the mouse pointer over the imported mail message in the message list
   which should cause a tooltip with the subject to popup

Results:
1. The listener will (after a slight delay) spew out 20,000 object:property-change:accessible-name events for the tooltip and then bail. An Orca user provided me with debut output with over 500,000 events.

2. Thunderbird becomes (and remains, from what I've seen) non-responsive and needs to be terminated. (Stacktrace will follow.)

Note: If you perform the steps with other messages, things work as expected. As best as I can tell, the bug only happens with certain MIME-encoded subjects.

	Joanmarie Diggs Reporter
	Comment 3 • 9 years ago

Ping? I just had to force quit Thunderbird because of this bug.

	Trevor Saunders (:tbsaunde) Assignee
	Comment 4 • 8 years ago

AtkObject stores the name as a C string, but nsCString can store strings with
'\0' in the middle.  That means that if we compute a name containing '\0'
nsCString.equals() will nevr consider that string to be equal to
AtkObject::name, however we only want to compare up to the first '\0' because
that is the only part Atk will ever see.  So we should use strncmp() instead of
nsCString.equals().

	David Bolter [:davidb] (NeedInfo me for attention)
	Comment 5 • 8 years ago

Comment on attachment 8704836 [details] [diff] [review]
use strncmp() instead of nsCString.equals() to compare names

Review of attachment 8704836 [details] [diff] [review]:
-----------------------------------------------------------------

I love your commit messages.

	Pulsebot
	Comment 6 • 8 years ago

https://hg.mozilla.org/integration/mozilla-inbound/rev/9133117f410c

	Phil Ringnalda (:philor)
	Comment 7 • 8 years ago
bugherder

https://hg.mozilla.org/mozilla-central/rev/9133117f410c

	Trevor Saunders (:tbsaunde) Assignee
	Comment 8 • 8 years ago

Comment on attachment 8704836 [details] [diff] [review]
use strncmp() instead of nsCString.equals() to compare names

Approval Request Comment
[Feature/regressing bug #]:none
[User impact if declined]:crashes with email subjects containing null bytes, and probably other places where the names of things contain '\0'
[Describe test coverage new/current, TreeHerder]: on m-c so for a week without regression, and manually tested the bug in thunderbird is gone.
[Risks and why]:  low, it should mean in the worst case we don't fire an event we should.
[String/UUID change made/needed]:

	Sylvestre Ledru [:Sylvestre]
	Comment 9 • 8 years ago

Trevor, does this has any potential impact on Firefox?
Thanks

	Trevor Saunders (:tbsaunde) Assignee
	Comment 10 • 8 years ago

(In reply to Sylvestre Ledru [:sylvestre] from comment #9)
> Trevor, does this has any potential impact on Firefox?
> Thanks

yes, I suspect that you can trigger the same bug in firefox rather easily, but I have not tried.  Its a rather odd edge case so I'm not totally suprised we haven't heard about it being a problem in Firefox.

	Sylvestre Ledru [:Sylvestre]
	Comment 11 • 8 years ago

Comment on attachment 8704836 [details] [diff] [review]
use strncmp() instead of nsCString.equals() to compare names

OK, let's take it. We still can always backout this patch if it causes unexpected regressions in Firefox.

	Carsten Book [:Tomcat]
	Comment 12 • 8 years ago
bugherder uplift

https://hg.mozilla.org/releases/mozilla-aurora/rev/acfb00a0a215

	Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)
	Comment 13 • 8 years ago

Moving to Core so I can set the flags to stop showing this in our uplift queries.