1212133 - crash in mozilla::a11y::DocAccessible::RemoveDependentIDsFor(mozilla::a11y::Accessible*, nsIAtom*)

Status: RESOLVED WORKSFORME

(Core :: Disability Access APIs, defect)

Description

[Trevor Saunders (:tbsaunde)]

This bug was filed from the Socorro interface and is 
report bp-840b56a3-64c0-4a40-9af4-d42822151006.
=============================================================

Comment 1

[alexander :surkov (:asurkov)]

any ideas why nsTArray<Accessible*>::Contains may crash, see [1] and [2]?

[1] http://hg.mozilla.org/mozilla-central/annotate/5f16c6c2b969/accessible/generic/DocAccessible.cpp#l1715
[2] http://hg.mozilla.org/mozilla-central/annotate/b56aeea0c470/xpcom/glue/nsTArray.h#l1098

Comment 2

[David Bolter [:davidb] (NeedInfo me for attention)]

A couple on Windows involving OOM:
report bp-5ad10efa-6833-413d-af8f-500812151009.
report bp-b0370a1b-6b09-4548-9c89-5e4372151007.

These crashes are currently very infrequent.

Comment 3

[Brian Birtles (:birtles)]

This just crashed facebook messenger for me in 44.0a2.
https://crash-stats.mozilla.com/report/index/7782c200-829c-43c4-8715-b52cd2151218

Comment 4

[David Bolter [:davidb] (NeedInfo me for attention)]

Alex can you recreate this in fb messenger?

Comment 5

[alexander :surkov (:asurkov)]

(In reply to David Bolter [:davidb] from comment #4)
> Alex can you recreate this in fb messenger?

no so far, I'll try on Windows, when I'll set up the machine

Comment 6

[Brian Birtles (:birtles)]

I'm trying to remember the exact steps that got me here. I think I typed someone's name in the search box, selected the name and then began typing the message. After about 1~2 seconds it crashed.

Comment 7

[Ritu Kothari (:ritu) (Inactive, please n-i to RyanVM, jcristau, or pascal)]

Surkov, this bug is a top crasher on Beta44. Hoping that we can get a fix/repro available soon. Thanks!

Comment 8

[alexander :surkov (:asurkov)]

(In reply to Ritu Kothari (:ritu) from comment #7)
> Surkov, this bug is a top crasher on Beta44. Hoping that we can get a
> fix/repro available soon. Thanks!

is the issue different from bug 1213281 which has been landed on release and aurora channels?

Comment 9

[Ritu Kothari (:ritu) (Inactive, please n-i to RyanVM, jcristau, or pascal)]

Surkov, bug 1213281 landed on Aurora44 (which is now Beta44) so this bug is a different issue.

Comment 10

[alexander :surkov (:asurkov)]

Attachment: patch

Comment 11

[alexander :surkov (:asurkov)]

https://treeherder.mozilla.org/#/jobs?repo=try&revision=afc13b65b8e3

Comment 12

[alexander :surkov (:asurkov)]

Comment on attachment 8704270 [details] [diff] [review]
patch

Approval Request Comment
[Feature/regressing bug #]:aria-owns implementation initially landed on this beta
[User impact if declined]:top crash
[Describe test coverage new/current, TreeHerder]:not covered
[Risks and why]: small, couple of null checks
[String/UUID change made/needed]:no

Comment 13

[Ritu Kothari (:ritu) (Inactive, please n-i to RyanVM, jcristau, or pascal)]

Alexander, could you please describe the test coverage you did on this patch? Was it locally and manually tested to ensure there were no obvious regressions? I will not be able to take a patch with "no test coverage" to Beta44.

Comment 14

[alexander :surkov (:asurkov)]

(In reply to Ritu Kothari (:ritu) from comment #13)
> Alexander, could you please describe the test coverage you did on this
> patch? Was it locally and manually tested to ensure there were no obvious
> regressions? I will not be able to take a patch with "no test coverage" to
> Beta44.

I meant there's no test coverage for the patch, because no steps to reproduce. Try server build was ok, so all mochiteset passed. Thus no obvious regressions.

Comment 15

[Ritu Kothari (:ritu) (Inactive, please n-i to RyanVM, jcristau, or pascal)]

Comment on attachment 8704270 [details] [diff] [review]
patch

not null checks, beta44+

Comment 16

[Ritu Kothari (:ritu) (Inactive, please n-i to RyanVM, jcristau, or pascal)]

Surkov, could you also request uplift to Aurora45?

Comment 17

[alexander :surkov (:asurkov)]

(In reply to Ritu Kothari (:ritu) from comment #16)
> Surkov, could you also request uplift to Aurora45?

beta and aurora have a quite different code, aurora might not need a patch like this

Comment 18

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/releases/mozilla-beta/rev/ac1d763699d4

Comment 19

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/releases/mozilla-b2g44_v2_5/rev/ac1d763699d4

Comment 20

[David Bolter [:davidb] (NeedInfo me for attention)]

Alex could you take another look here? We're still crashing in release (FF 44):
https://crash-stats.mozilla.com/signature/?product=Firefox&accessibility=__true__&signature=nsTArray_Impl%3CT%3E%3A%3AContains%3CT%3E+|+mozilla%3A%3Aa11y%3A%3ADocAccessible%3A%3ARemoveDependentIDsFor&_columns=date&_columns=product&_columns=version&_columns=build_id&_columns=platform&_columns=reason&_columns=address&page=1#reports

Comment 21

[alexander :surkov (:asurkov)]

it's not an issue for nightly, if it should be fixed for 44, then the null check should help

Comment 22

[BugBot [:suhaib / :marco/ :calixte]]

Crash volume for signature 'mozilla::a11y::DocAccessible::RemoveDependentIDsFor':
 - nightly (version 50): 4 crashes from 2016-06-06.
 - aurora  (version 49): 10 crashes from 2016-06-07.
 - beta    (version 48): 30 crashes from 2016-06-06.
 - release (version 47): 0 crashes from 2016-05-31.
 - esr     (version 45): 0 crashes from 2016-04-07.

Crash volume on the last weeks:
            W. N-1  W. N-2  W. N-3  W. N-4  W. N-5  W. N-6  W. N-7
 - nightly       0       0       1       1       0       1       0
 - aurora        0       2       1       0       2       3       1
 - beta          5       4       2       5       4       4       4
 - release       0       0       0       0       0       0       0
 - esr           0       0       0       0       0       0       0

Affected platform: Windows

Comment 23

[alexander :surkov (:asurkov)]

can see few crashes on 58 (https://crash-stats.mozilla.com/signature/?signature=mozilla%3A%3Aa11y%3A%3ADocAccessible%3A%3ARemoveDependentIDsFor&date=%3E%3D2017-12-05T10%3A42%3A09.000Z&date=%3C2018-03-05T10%3A42%3A09.000Z&_columns=date&_columns=product&_columns=version&_columns=build_id&_columns=platform&_columns=reason&_columns=address&_columns=install_time&_sort=-version&_sort=-date&page=1)

Comment 24

[BugBot [:suhaib / :marco/ :calixte]]

Closing because no crashes reported for 12 weeks.

Comment 25

[BugBot [:suhaib / :marco/ :calixte]]

Closing because no crashes reported for 12 weeks.

Comment 26

[Calixte Denizet (:calixte)]

There are still some crashes so reopen it.

Comment 27

[BugBot [:suhaib / :marco/ :calixte]]

Closing because no crashes reported for 12 weeks.