1141465 - crash in nsIPresShell::GetRootScrollFrameAsScrollable() const

Status: RESOLVED WORKSFORME

(Core :: Disability Access APIs, defect)

Description

[Ioana Chiorean]

This bug was filed from the Socorro interface and is 
report bp-a474b35b-27d2-4c9b-a970-3e88a2150310.

Happened while closing a youtube tab 
=============================================================
0	libxul.so	nsIPresShell::GetRootScrollFrameAsScrollable() const	layout/base/nsDisplayList.h
1	libxul.so	mozilla::a11y::DocAccessible::RemoveEventListeners()	accessible/generic/DocAccessible-inl.h
2	libxul.so	mozilla::a11y::DocAccessible::Shutdown()	accessible/generic/DocAccessible.cpp
3	libxul.so	mozilla::a11y::NotificationController::WillRefresh(mozilla::TimeStamp)	accessible/base/NotificationController.cpp
4	libxul.so	nsRefreshDriver::Tick(long, mozilla::TimeStamp)	layout/base/nsRefreshDriver.cpp
5	libxul.so	mozilla::RefreshDriverTimer::Tick(long, mozilla::TimeStamp)	layout/base/nsRefreshDriver.cpp
6	libxul.so	mozilla::RefreshDriverTimer::TimerTick(nsITimer*, void*)	layout/base/nsRefreshDriver.cpp
7	libxul.so	nsTimerImpl::Fire()	xpcom/threads/nsTimerImpl.cpp
8	libxul.so	nsTimerEvent::Run()	xpcom/threads/nsTimerImpl.cpp
9	libxul.so	nsThread::ProcessNextEvent(bool, bool*)	xpcom/threads/nsThread.cpp
10	libxul.so	NS_ProcessNextEvent(nsIThread*, bool)	xpcom/glue/nsThreadUtils.cpp
11	libxul.so	mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*)	ipc/glue/MessagePump.cpp
12	libxul.so	MessageLoop::Run()	ipc/chromium/src/base/message_loop.cc
13	libxul.so	nsBaseAppShell::Run()	widget/nsBaseAppShell.cpp
14	libxul.so	nsAppStartup::Run()	toolkit/components/startup/nsAppStartup.cpp
15	libxul.so	XREMain::XRE_mainRun()	toolkit/xre/nsAppRunner.cpp
16	libxul.so	XREMain::XRE_main(int, char**, nsXREAppData const*)	toolkit/xre/nsAppRunner.cpp
17	libxul.so	XRE_main	toolkit/xre/nsAppRunner.cpp
18	firefox	do_main	browser/app/nsBrowserApp.cpp
19	firefox	main	browser/app/nsBrowserApp.cpp
Ø 20	libc-2.15.so	libc-2.15.so@0x2176c	
21	firefox	_init	
22	firefox	je_tcache_get_hard	memory/jemalloc/src/include/jemalloc/internal/tsd.h
23	firefox	__libc_csu_fini	
24	firefox	je_tcache_get_hard	memory/jemalloc/src/include/jemalloc/internal/tsd.h
25	firefox	_start

Comment 1

[Trevor Saunders (:tbsaunde)]

While its not really clear I'd guess this is crashing because mFrameConstructor->GetRootFrame() returns null.

DocAccessible->mPresShell can't be null because we are in DocAccessible::Shutdown() which bails if its null, and the only way for it to become null is for Shutdown to finish.

So unless there's conditions under which GetRootScrollrame may not be called I'd think this is a layout bug.

Comment 2

[:Gijs (he/him)]

No crashes with this stack in the last 6 months, and not enough before that to even get a graph in crash-stats --> wfm