Closed Bug 1141465 Opened 7 years ago Closed 6 years ago

crash in nsIPresShell::GetRootScrollFrameAsScrollable() const

Categories

(Core :: Disability Access APIs, defect)

39 Branch
All
Linux
defect
Not set
critical

Tracking

()

RESOLVED WORKSFORME

People

(Reporter: chiorean.ioana, Unassigned)

Details

(Keywords: crash)

Crash Data

This bug was filed from the Socorro interface and is 
report bp-a474b35b-27d2-4c9b-a970-3e88a2150310.

Happened while closing a youtube tab 
=============================================================
0	libxul.so	nsIPresShell::GetRootScrollFrameAsScrollable() const	layout/base/nsDisplayList.h
1	libxul.so	mozilla::a11y::DocAccessible::RemoveEventListeners()	accessible/generic/DocAccessible-inl.h
2	libxul.so	mozilla::a11y::DocAccessible::Shutdown()	accessible/generic/DocAccessible.cpp
3	libxul.so	mozilla::a11y::NotificationController::WillRefresh(mozilla::TimeStamp)	accessible/base/NotificationController.cpp
4	libxul.so	nsRefreshDriver::Tick(long, mozilla::TimeStamp)	layout/base/nsRefreshDriver.cpp
5	libxul.so	mozilla::RefreshDriverTimer::Tick(long, mozilla::TimeStamp)	layout/base/nsRefreshDriver.cpp
6	libxul.so	mozilla::RefreshDriverTimer::TimerTick(nsITimer*, void*)	layout/base/nsRefreshDriver.cpp
7	libxul.so	nsTimerImpl::Fire()	xpcom/threads/nsTimerImpl.cpp
8	libxul.so	nsTimerEvent::Run()	xpcom/threads/nsTimerImpl.cpp
9	libxul.so	nsThread::ProcessNextEvent(bool, bool*)	xpcom/threads/nsThread.cpp
10	libxul.so	NS_ProcessNextEvent(nsIThread*, bool)	xpcom/glue/nsThreadUtils.cpp
11	libxul.so	mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*)	ipc/glue/MessagePump.cpp
12	libxul.so	MessageLoop::Run()	ipc/chromium/src/base/message_loop.cc
13	libxul.so	nsBaseAppShell::Run()	widget/nsBaseAppShell.cpp
14	libxul.so	nsAppStartup::Run()	toolkit/components/startup/nsAppStartup.cpp
15	libxul.so	XREMain::XRE_mainRun()	toolkit/xre/nsAppRunner.cpp
16	libxul.so	XREMain::XRE_main(int, char**, nsXREAppData const*)	toolkit/xre/nsAppRunner.cpp
17	libxul.so	XRE_main	toolkit/xre/nsAppRunner.cpp
18	firefox	do_main	browser/app/nsBrowserApp.cpp
19	firefox	main	browser/app/nsBrowserApp.cpp
Ø 20	libc-2.15.so	libc-2.15.so@0x2176c	
21	firefox	_init	
22	firefox	je_tcache_get_hard	memory/jemalloc/src/include/jemalloc/internal/tsd.h
23	firefox	__libc_csu_fini	
24	firefox	je_tcache_get_hard	memory/jemalloc/src/include/jemalloc/internal/tsd.h
25	firefox	_start
Component: General → Disability Access APIs
Product: Firefox → Core
Version: Trunk → 39 Branch
While its not really clear I'd guess this is crashing because mFrameConstructor->GetRootFrame() returns null.

DocAccessible->mPresShell can't be null because we are in DocAccessible::Shutdown() which bails if its null, and the only way for it to become null is for Shutdown to finish.

So unless there's conditions under which GetRootScrollrame may not be called I'd think this is a layout bug.
Crash Signature: [@ nsIPresShell::GetRootScrollFrameAsScrollable() const] → [@ nsIPresShell::GetRootScrollFrameAsScrollable() const] [@ nsIPresShell::GetRootScrollFrameAsScrollable const]
No crashes with this stack in the last 6 months, and not enough before that to even get a graph in crash-stats --> wfm
Status: NEW → RESOLVED
Closed: 6 years ago
Resolution: --- → WORKSFORME
You need to log in before you can comment on or make changes to this bug.