1077875 - crash in mozilla::a11y::Accessible::BindToParent(mozilla::a11y::Accessible*, unsigned int)

Status: RESOLVED WORKSFORME

(Core :: Disability Access APIs, defect)

Description

[Martijn Wargers (dead)]

Attachment: crash1.xhtml

See testcase, which crashes current trunk build when accessibility is turned on.

This bug was filed from the Socorro interface and is 
report bp-765d20eb-76e9-41c4-a5e0-dc92f2141004.
=============================================================
0 	XUL 	mozilla::a11y::Accessible::BindToParent(mozilla::a11y::Accessible*, unsigned int) 	obj-firefox/x86_64/dist/include/nsTArray.h
1 	XUL 	mozilla::a11y::Accessible::InsertChildAt(unsigned int, mozilla::a11y::Accessible*) 	accessible/generic/Accessible.cpp
2 	XUL 	mozilla::a11y::AccessibleWrap::InsertChildAt(unsigned int, mozilla::a11y::Accessible*) 	accessible/mac/AccessibleWrap.mm
3 	XUL 	mozilla::a11y::HyperTextAccessible::CacheChildren() 	accessible/generic/Accessible.h
4 	XUL 	mozilla::a11y::DocAccessible::CacheChildrenInSubtree(mozilla::a11y::Accessible*, mozilla::a11y::Accessible**) 	accessible/generic/Accessible.cpp
5 	XUL 	mozilla::a11y::DocAccessible::ProcessContentInserted(mozilla::a11y::Accessible*, nsTArray<nsCOMPtr<nsIContent> > const*) 	accessible/generic/DocAccessible.cpp
6 	XUL 	mozilla::a11y::NotificationController::ContentInsertion::Process() 	accessible/base/NotificationController.cpp
7 	XUL 	mozilla::a11y::NotificationController::WillRefresh(mozilla::TimeStamp) 	accessible/base/NotificationController.cpp
8 	XUL 	nsRefreshDriver::Tick(long long, mozilla::TimeStamp) 	layout/base/nsRefreshDriver.cpp
9 	XUL 	mozilla::RefreshDriverTimer::Tick() 	layout/base/nsRefreshDriver.cpp
10 	XUL 	nsTimerImpl::Fire() 	xpcom/threads/nsTimerImpl.cpp
11 	XUL 	nsTimerEvent::Run() 	xpcom/threads/nsTimerImpl.cpp

Comment 1

[David Bolter [:davidb] (NeedInfo me for attention)]

Possibly related to bug 1072792.

Comment 2

[alexander :surkov (:asurkov)]

a low volume crash, 3 crashes at 51 in last 3 months: https://crash-stats.mozilla.com/signature/?signature=OOM%20%7C%20large%20%7C%20mozalloc_abort%20%7C%20mozalloc_handle_oom%20%7C%20moz_xrealloc%20%7C%20mozilla%3A%3Aa11y%3A%3AAccessible%3A%3ABindToParent&date=%3E%3D2016-12-14T17%3A35%3A45.000Z&date=%3C2017-03-14T17%3A35%3A45.000Z&_columns=date&_columns=product&_columns=version&_columns=build_id&_columns=platform&_columns=reason&_columns=address&_sort=-date&page=1#reports

Comment 3

[alexander :surkov (:asurkov)]

45 - a single crash for last 3 months