753095 - crash in mozilla::a11y::HTMLTextFieldAccessible::NativeRole

Status: RESOLVED DUPLICATE of bug 753093

(Core :: Disability Access APIs, defect)

Description

[Scoobidiver (away)]

There's one crash in 15.0a1/20120508.

Signature 	mozilla::a11y::HTMLTextFieldAccessible::NativeRole More Reports Search
UUID	f3a06089-00b3-4b10-9dd2-7b6902120508
Date Processed	2012-05-08 19:24:40
Uptime	458
Last Crash	8.6 minutes before submission
Install Age	14.9 minutes since version was first installed.
Install Time	2012-05-08 19:09:12
Product	FennecAndroid
Version	15.0a1
Build ID	20120508055912
Release Channel	nightly
OS	Linux
OS Version	0.0.0 Linux 2.6.35.10-g4dcb781 #1 PREEMPT Wed Nov 23 15:14:27 CST 2011 armv7l
Build Architecture	arm
Build Architecture Info	
Crash Reason	SIGSEGV
Crash Address	0x0
App Notes 	
AdapterVendorID: glacier, AdapterDeviceID: HTC Glacier.
AdapterDescription: 'Model: 'HTC Glacier', Product: 'htc_glacier', Manufacturer: 'HTC', Hardware: 'glacier''.
HTC HTC Glacier
tmobile/htc_glacier/glacier:2.3.4/GRJ22/209954.1:user/release-keys
EMCheckCompatibility	True

Frame 	Module 	Signature 	Source
0 	libxul.so 	mozilla::a11y::HTMLTextFieldAccessible::NativeRole 	accessible/src/html/HTMLFormControlAccessible.cpp:379
1 	libxul.so 	RuleCache::ApplyFilter 	accessible/src/generic/Accessible-inl.h:17
2 	libxul.so 	nsAccessiblePivot::SearchForward 	accessible/src/base/nsAccessiblePivot.cpp:431
3 	libxul.so 	nsAccessiblePivot::MoveNext 	accessible/src/base/nsAccessiblePivot.cpp:221
4 	libxul.so 	NS_InvokeByIndex_P 	xpcom/reflect/xptcall/src/md/unix/xptcinvoke_arm.cpp:194
5 	libxul.so 	XPCWrappedNative::CallMethod 	js/xpconnect/src/XPCWrappedNative.cpp:3102
6 	libxul.so 	XPC_WN_CallMethod 	js/xpconnect/src/XPCWrappedNativeJSOps.cpp:1541
7 	libxul.so 	js::Interpret 	js/src/jscntxtinlines.h:426
8 	libxul.so 	js::RunScript 	js/src/jsinterp.cpp:480
9 	libxul.so 	js::Invoke 	js/src/jsinterp.cpp:540
10 	libxul.so 	js::ProxyHandler::call 	js/src/jsproxy.cpp:340
11 	libxul.so 	js::Wrapper::call 	js/src/jswrapper.cpp:276
12 	libxul.so 	js::CrossCompartmentWrapper::call 	js/src/jswrapper.cpp:758
13 	libxul.so 	proxy_Call 	js/src/jsproxy.cpp:911
14 	libxul.so 	js::Invoke 	js/src/jscntxtinlines.h:426
15 	libxul.so 	JS_CallFunctionValue 	js/src/jsapi.cpp:5429
16 	libxul.so 	nsXPCWrappedJSClass::CallMethod 	js/xpconnect/src/XPCWrappedJSClass.cpp:1509
17 	libxul.so 	nsXPCWrappedJS::CallMethod 	js/xpconnect/src/XPCWrappedJS.cpp:616
18 	libxul.so 	PrepareAndDispatch 	xpcom/reflect/xptcall/src/md/unix/xptcstubs_arm.cpp:138
...

More reports at:
https://crash-stats.mozilla.com/report/list?signature=mozilla%3A%3Aa11y%3A%3AHTMLTextFieldAccessible%3A%3ANativeRole

Comment 1

[Trevor Saunders (:tbsaunde)]

I suspect that the pivot stuff is dealing with a defunct accessible for some reason.  I'm not sure off hand why its defunct but connected to the tree, but its hard to think of another reason this would happen.

Comment 2

[Trevor Saunders (:tbsaunde)]

the fix for bug 753093 should almost certainly address this too.

Comment 3

[Eitan Isaacson [:eeejay]]

(In reply to Trevor Saunders (:tbsaunde) from comment #1)
> I suspect that the pivot stuff is dealing with a defunct accessible for some
> reason.  I'm not sure off hand why its defunct but connected to the tree,
> but its hard to think of another reason this would happen.

Doesn't have to be connected to the tree. We have a hard reference to the accessible, and it could have gone defunct for many reasons. Like a drop down menu that disappears. You have a better understanding of the accessible life-cycle, but those are my assumptions.

Comment 4

[Eitan Isaacson [:eeejay]]

Marking this as a duplicate since it seems to be the same issue. The depends/blocks thing doesn't really make sense here.