1336770 - Crash in nsTArray_Impl<T>::IndexOf<T> | mozilla::a11y::ProxyAccessibleBase<T>::ClearChildDoc

Status: RESOLVED FIXED

(Core :: Disability Access APIs, defect)

Description

[Alice0775 White]

Attachment: about_support.txt

This bug was filed from the Socorro interface and is 
report bp-567fab6c-6b03-4a73-a841-ddf312170205.
=============================================================

Browser crash.

Comment 1

[Alice0775 White]

Reproducible: 80/100 probability

STR
0. I am using ATOK2016 (this triggers a11y)
1. Open http://360.hatenadiary.jp/entry/2016/02/03/194624 in tab[1]
2. Open about:support in a new tab[2]
3. Switch to tab[1]
4. Navigation Back and forward

5. Repeat from step1-

Comment 2

[Alice0775 White]

nightly54.0a1(2017-02-05) bp-595a33ee-9ad5-4612-bbab-736132170205

Comment 3

[Alice0775 White]

[Tracking Requested - why for this release]: reproducible crash

nightly54.0a1(2017-02-06) bp-9dd4dea1-87aa-4a93-8d80-387502170206
aurora53.0a2(2017-02-06) bp-44f90428-ffd0-48c3-b857-726202170206

Comment 4

[Alice0775 White]

similar crash of Bug 1336093 is still existing.

Comment 5

[Alice0775 White]

Attachment: about_suppot.txt aurora53.0a2

Comment 6

[Marco Zehe (:MarcoZ)]

(In reply to Alice0775 White from comment #4)
> similar crash of Bug 1336093 is still existing.

Not for me. Since the backout, the crashes have disappeared for me.

Comment 7

[Alice0775 White]

bp-f24eeaf1-9433-46e6-865c-495592170206

Comment 8

[Brian Birtles (:birtles, Feb 26~ parental leave)]

I am still hitting this crash regularly including on today's nightly. I'm on a Surface Book Pro. I presume the touchscreen there triggers a11y. I'm also using Microsoft Japanese IME so perhaps that's what's triggering it. Either this bug or bug 1326084, I'm not really sure how they relate.

Comment 9

[Marcia Knous [:marcia]]

Tracking 53/54+ for this crash which is easily reproducible for some users.

Comment 10

[Emma Stott]

I'm not sure if this bug and bug 1333987 are the same, so I'm posting this in both.

I'm also having very frequent crashes with this error, particularly when looking at imdb.com or amazon.co.uk.

I'm running Nightly, and first started getting these crashes in build 20170208030203 on 2017-02-10.

I have quite a few extensions, so I made a new profile and reproduced it there as follows:

1. In the new profile, went to http://www.imdb.com/title/tt3230854/
2. Clicked into season 1 (http://www.imdb.com/title/tt3230854/episodes?season=1&ref_=tt_eps_sn_1).
3. Went back, and clicked on season 2 (http://www.imdb.com/title/tt3230854/episodes?season=2&ref_=tt_eps_sn_2).
4. Repeat this a few times, going from one imdb page to another.
5. Opened a new tab and began typing amazon.co.uk.
--> Crash.

Here's the bug report: bp-804cab2c-99b1-41b1-a752-886062170212

I wasn't actually able to get back into that profile to get the about:support contents, as it crashed everytime whilst loading imdb. Here are those bug reports:

- bp-3e1ffbfa-1f74-486c-a4e6-405fd2170212
- bp-4fc20479-42d3-4ef7-b9a1-7f7332170212
- bp-f5516010-f950-4975-8df0-f48f92170212
- bp-d7ea0753-10fa-464c-ac69-c21362170212

Let me know if there's anything else I can provide that would be helpful.

Thanks! :)

Comment 11

[Jim Mathies [:jimm]]

(In reply to Emma Stott from comment #10)
> I'm not sure if this bug and bug 1333987 are the same, so I'm posting this
> in both.
> 
> I'm also having very frequent crashes with this error, particularly when
> looking at imdb.com or amazon.co.uk.
> 
> I'm running Nightly, and first started getting these crashes in build
> 20170208030203 on 2017-02-10.
> 
> I have quite a few extensions, so I made a new profile and reproduced it
> there as follows:
> 
> 1. In the new profile, went to http://www.imdb.com/title/tt3230854/
> 2. Clicked into season 1
> (http://www.imdb.com/title/tt3230854/episodes?season=1&ref_=tt_eps_sn_1).
> 3. Went back, and clicked on season 2
> (http://www.imdb.com/title/tt3230854/episodes?season=2&ref_=tt_eps_sn_2).
> 4. Repeat this a few times, going from one imdb page to another.
> 5. Opened a new tab and began typing amazon.co.uk.
> --> Crash.
> 
> Here's the bug report: bp-804cab2c-99b1-41b1-a752-886062170212
> 
> I wasn't actually able to get back into that profile to get the
> about:support contents, as it crashed everytime whilst loading imdb. Here
> are those bug reports:
> 
> - bp-3e1ffbfa-1f74-486c-a4e6-405fd2170212
> - bp-4fc20479-42d3-4ef7-b9a1-7f7332170212
> - bp-f5516010-f950-4975-8df0-f48f92170212
> - bp-d7ea0753-10fa-464c-ac69-c21362170212
> 
> Let me know if there's anything else I can provide that would be helpful.
> 
> Thanks! :)

Are you running software from a company called Actual Tools? If so I'd appreciate you disabling that and trying to reproduce the crash. I'm looking for ways to reproduce the issue locally.

Comment 12

[David Bolter [:davidb] (NeedInfo me for attention)]

Mike I think you got this crash by hitting F5 a bunch when a flash video is in the page? I think you use a windows 10 surface right? No assistive tech or IME software involved?

Comment 13

[Mike Hoye [:mhoye]]

Surface Book, Windows 10-current, Nightly current. Flash video is playing when I start hitting F5, and I can reproduce at will. I'm happy to turn this machine over to somebody if they want to fix it.

Comment 14

[Alice0775 White]

The crash seems to fix for me on Nightly54.0a1[1].

[1]
https://hg.mozilla.org/mozilla-central/rev/195049fabb7ac5709e5f75614ba630ba3d1b5a9b
Mozilla/5.0 (Windows NT 10.0; WOW64; rv:54.0) Gecko/20100101 Firefox/54.0 ID:20170214030231



Fixed window:
https://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=c27179ee59e9eb226224ec11b907ccce6289fc0c&tochange=62f820d36c917dd3a877e8e8b3489845805cbb4c

The following patch seems to fix the crash.
62f820d36c91	Trevor Saunders — bug 1339128 - reference parent proxy by id r=eeejay

[e-mail], Is it possible to uplift the fix of bug 1339128 to Aurora53.0a2?

Comment 15

[David Bolter [:davidb] (NeedInfo me for attention)]

Good news: I'm not seeing any stacks since build 20170213030206.

Comment 16

[Mike Hoye [:mhoye]]

I am no longer able to reproduce this per my above method.

Comment 18

[Jim Mathies [:jimm]]

Do we know which landing might have fixed this?

Comment 19

[Jim Mathies [:jimm]]

(In reply to Alice0775 White from comment #14)
> The crash seems to fix for me on Nightly54.0a1[1].
> 
> [1]
> https://hg.mozilla.org/mozilla-central/rev/
> 195049fabb7ac5709e5f75614ba630ba3d1b5a9b
> Mozilla/5.0 (Windows NT 10.0; WOW64; rv:54.0) Gecko/20100101 Firefox/54.0
> ID:20170214030231
> 
> 
> 
> Fixed window:
> https://hg.mozilla.org/integration/mozilla-inbound/
> pushloghtml?fromchange=c27179ee59e9eb226224ec11b907ccce6289fc0c&tochange=62f8
> 20d36c917dd3a877e8e8b3489845805cbb4c
> 
> The following patch seems to fix the crash.
> 62f820d36c91	Trevor Saunders — bug 1339128 - reference parent proxy by id
> r=eeejay
> 
> [e-mail], Is it possible to uplift the fix of bug
> 1339128 to Aurora53.0a2?

ah, nm, thanks Alice!