Closed Bug 1186528 Opened 4 years ago Closed 4 years ago
crash in mozalloc
_abort(char const* const) | NS _Debug Break | mozilla::a11y::PDoc Accessible::Transition(mozilla::a11y::PDoc Accessible::State, mozilla::ipc::Trigger, mozilla::a11y::PDoc Accessible::State*)
This bug was filed from the Socorro interface and is report bp-0ef25255-9822-42f9-8629-d5b8c2150719. ============================================================= Onset range: https://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=283b5f38ce57&tochange=c95ebeebbc5d
I wonder if this is just a different version of bug 1185157?
Unfortunately this isn't fixed by bug 1185157 and is the #2 top crasher on nightly. We need an owner.
Assignee: nobody → tbsaunde+mozbugs
Billm I'm not really sure what this is about, can you explain what is going on with the actor's state?
Flags: needinfo?(tbsaunde+mozbugs) → needinfo?(wmccloskey)
Sorry, it took me some digging to figure this out. I think this is a regression from bug 1181177. The assertion is saying that the actor is in state __Dead when we call SendShutdown in DocAccessibleChild::Shutdown. Normally that would mean that we've already called Send__delete__ on the DocAccessibleChild. But it can also mean that we never set up IPC for that actor. I think the latter is the case here. The problem happens here: http://hg.mozilla.org/mozilla-central/annotate/62cd40885e93/accessible/base/DocManager.cpp#l459 If docShell or tabChild are null, then we create a DocAccessibleChild and never initialize it for IPC via SendPDocAccessibleConstructor. When we try to call Shutdown on it, we crash. Can we just avoid creating the DocAccessibleChild in these cases?
Flags: needinfo?(wmccloskey) → needinfo?(tbsaunde+mozbugs)
You need to log in before you can comment on or make changes to this bug.