Closed Bug 1141465 Opened 7 years ago Closed 6 years ago

crash in nsIPresShell::GetRootScrollFrameAsScrollable() const


(Core :: Disability Access APIs, defect)

39 Branch
Not set





(Reporter: chiorean.ioana, Unassigned)


(Keywords: crash)

Crash Data

This bug was filed from the Socorro interface and is 
report bp-a474b35b-27d2-4c9b-a970-3e88a2150310.

Happened while closing a youtube tab 
0	nsIPresShell::GetRootScrollFrameAsScrollable() const	layout/base/nsDisplayList.h
1	mozilla::a11y::DocAccessible::RemoveEventListeners()	accessible/generic/DocAccessible-inl.h
2	mozilla::a11y::DocAccessible::Shutdown()	accessible/generic/DocAccessible.cpp
3	mozilla::a11y::NotificationController::WillRefresh(mozilla::TimeStamp)	accessible/base/NotificationController.cpp
4	nsRefreshDriver::Tick(long, mozilla::TimeStamp)	layout/base/nsRefreshDriver.cpp
5	mozilla::RefreshDriverTimer::Tick(long, mozilla::TimeStamp)	layout/base/nsRefreshDriver.cpp
6	mozilla::RefreshDriverTimer::TimerTick(nsITimer*, void*)	layout/base/nsRefreshDriver.cpp
7	nsTimerImpl::Fire()	xpcom/threads/nsTimerImpl.cpp
8	nsTimerEvent::Run()	xpcom/threads/nsTimerImpl.cpp
9	nsThread::ProcessNextEvent(bool, bool*)	xpcom/threads/nsThread.cpp
10	NS_ProcessNextEvent(nsIThread*, bool)	xpcom/glue/nsThreadUtils.cpp
11	mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*)	ipc/glue/MessagePump.cpp
12	MessageLoop::Run()	ipc/chromium/src/base/
13	nsBaseAppShell::Run()	widget/nsBaseAppShell.cpp
14	nsAppStartup::Run()	toolkit/components/startup/nsAppStartup.cpp
15	XREMain::XRE_mainRun()	toolkit/xre/nsAppRunner.cpp
16	XREMain::XRE_main(int, char**, nsXREAppData const*)	toolkit/xre/nsAppRunner.cpp
17	XRE_main	toolkit/xre/nsAppRunner.cpp
18	firefox	do_main	browser/app/nsBrowserApp.cpp
19	firefox	main	browser/app/nsBrowserApp.cpp
Ø 20	
21	firefox	_init	
22	firefox	je_tcache_get_hard	memory/jemalloc/src/include/jemalloc/internal/tsd.h
23	firefox	__libc_csu_fini	
24	firefox	je_tcache_get_hard	memory/jemalloc/src/include/jemalloc/internal/tsd.h
25	firefox	_start
Component: General → Disability Access APIs
Product: Firefox → Core
Version: Trunk → 39 Branch
While its not really clear I'd guess this is crashing because mFrameConstructor->GetRootFrame() returns null.

DocAccessible->mPresShell can't be null because we are in DocAccessible::Shutdown() which bails if its null, and the only way for it to become null is for Shutdown to finish.

So unless there's conditions under which GetRootScrollrame may not be called I'd think this is a layout bug.
Crash Signature: [@ nsIPresShell::GetRootScrollFrameAsScrollable() const] → [@ nsIPresShell::GetRootScrollFrameAsScrollable() const] [@ nsIPresShell::GetRootScrollFrameAsScrollable const]
No crashes with this stack in the last 6 months, and not enough before that to even get a graph in crash-stats --> wfm
Closed: 6 years ago
Resolution: --- → WORKSFORME
You need to log in before you can comment on or make changes to this bug.