1186528 - crash in mozalloc_abort(char const* const) | NS_DebugBreak | mozilla::a11y::PDocAccessible::Transition(mozilla::a11y::PDocAccessible::State, mozilla::ipc::Trigger, mozilla::a11y::PDocAccessible::State*)

Status: RESOLVED FIXED

(Core :: Disability Access APIs, defect)

Description

[David Bolter [:davidb] (NeedInfo me for attention)]

This bug was filed from the Socorro interface and is 
report bp-0ef25255-9822-42f9-8629-d5b8c2150719.
=============================================================

Onset range: https://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=283b5f38ce57&tochange=c95ebeebbc5d

Comment 1

[Trevor Saunders (:tbsaunde)]

I wonder if this is just a different version of  bug 1185157?

Comment 2

[David Bolter [:davidb] (NeedInfo me for attention)]

Unfortunately this isn't fixed by bug 1185157 and is the #2 top crasher on nightly. We need an owner.

Comment 3

[Trevor Saunders (:tbsaunde)]

Billm I'm not really sure what this is about, can you explain what is going on with the actor's state?

Comment 4

[Bill McCloskey [inactive unless it's an emergency] (:billm)]

Sorry, it took me some digging to figure this out. I think this is a regression from bug 1181177.

The assertion is saying that the actor is in state __Dead when we call SendShutdown in DocAccessibleChild::Shutdown. Normally that would mean that we've already called Send__delete__ on the DocAccessibleChild. But it can also mean that we never set up IPC for that actor. I think the latter is the case here.

The problem happens here:
http://hg.mozilla.org/mozilla-central/annotate/62cd40885e93/accessible/base/DocManager.cpp#l459
If docShell or tabChild are null, then we create a DocAccessibleChild and never initialize it for IPC via SendPDocAccessibleConstructor. When we try to call Shutdown on it, we crash.

Can we just avoid creating the DocAccessibleChild in these cases?

Comment 5

[Trevor Saunders (:tbsaunde)]

Attachment: don't create a DocAccessibleChild if we can't tell the parent process about it

Comment 6

[Pulsebot]

https://hg.mozilla.org/integration/mozilla-inbound/rev/bb6a924f9325

Comment 7

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/bb6a924f9325