Closed Bug 1213606 Opened 4 years ago Closed 4 years ago

crash in PLDHashTable::Remove(void const*)

Categories

(Core :: Disability Access APIs, defect, critical)

defect
Not set
critical

Tracking

()

RESOLVED FIXED
mozilla44
Tracking Status
firefox42 --- unaffected
firefox43 + fixed
firefox44 + fixed

People

(Reporter: mats, Assigned: tbsaunde)

Details

(4 keywords)

Crash Data

Attachments

(2 files)

This bug was filed from the Socorro interface and is 
report bp-a239e39e-0b10-4ca5-bd15-c76692151008.
=============================================================

Appears to be a recent regression in v43 and v44.  The first crash report
I can find is for build 2015091703.  It's the #2 Top Crash in v43.
The crash occurs on all platforms.

The stack looks similar to bug 1187055.

PLDHashTable::Remove(void const*)
mozilla::a11y::ProxyDestroyed(mozilla::a11y::ProxyAccessible*)
mozilla::a11y::DocAccessibleParent::Destroy()
mozilla::a11y::DocAccessibleParent::ActorDestroy(mozilla::ipc::IProtocolManager<mozilla::ipc::IProtocol>::ActorDestroyReason)
mozilla::a11y::PDocAccessibleParent::DestroySubtree(mozilla::ipc::IProtocolManager<mozilla::ipc::IProtocol>::ActorDestroyReason)
mozilla::dom::PBrowserParent::DestroySubtree(mozilla::ipc::IProtocolManager<mozilla::ipc::IProtocol>::ActorDestroyReason)
mozilla::dom::PContentParent::DestroySubtree(mozilla::ipc::IProtocolManager<mozilla::ipc::IProtocol>::ActorDestroyReason)
mozilla::dom::PContentParent::OnChannelError()
...

More Reports:
https://crash-stats.mozilla.com/report/list?product=Firefox&signature=PLDHashTable%3A%3ARemove%28void+const%2A%29
[Tracking Requested - why for this release]: recent crash regression (topcrash)
This is the #1 topcrash for 43. 

Trevor, since you worked on bug 1187055, do you want to have a crack at this one?
Flags: needinfo?(tbsaunde+mozbugs)
Keywords: access
Crash Signature: [@ PLDHashTable::Remove(void const*)] → [@ PLDHashTable::Remove(void const*)] [@ PLDHashTable::Remove]
> Appears to be a recent regression in v43 and v44.  The first crash report
> I can find is for build 2015091703.  It's the #2 Top Crash in v43.
> The crash occurs on all platforms.

actually I'm pretty sure its windows only.  The only linux crashes I could find were some dom/quota bug that got misscategorized because of having the same first stack frame.  The code that crashes is also windows only so that seems like a good reason to think it doesn't effect anything else.


(In reply to Liz Henry (:lizzard) (needinfo? me) from comment #2)
> This is the #1 topcrash for 43. 
> 
> Trevor, since you worked on bug 1187055, do you want to have a crack at this
> one?

well, I don't have an idea how it can happen, but I can work around it I think.
Flags: needinfo?(tbsaunde+mozbugs)
I experienced this crash on a Mac.
Comment on attachment 8673694 [details] [diff] [review]
assert that we don't destroy a document's proxy until we destroy all of its children

Review of attachment 8673694 [details] [diff] [review]:
-----------------------------------------------------------------

::: accessible/ipc/DocAccessibleParent.cpp
@@ +261,5 @@
>    for (uint32_t i = childDocCount - 1; i < childDocCount; i--)
>      mChildDocs[i]->Destroy();
>  
>    for (auto iter = mAccessibles.Iter(); !iter.Done(); iter.Next()) {
> +    MOZ_ASSERT(iter.Get()->mProxy != this);

I... ok...
Attachment #8673694 - Flags: review?(dbolter) → review+
Attachment #8673695 - Flags: review?(dbolter) → review+
Assignee: nobody → tbsaunde+mozbugs
https://hg.mozilla.org/mozilla-central/rev/01779f96009b
https://hg.mozilla.org/mozilla-central/rev/4b7985e5a345
Status: NEW → RESOLVED
Closed: 4 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla44
Can you request uplift for this, to aurora? Thanks!
Flags: needinfo?(tbsaunde+mozbugs)
Flags: needinfo?(dbolter)
Comment on attachment 8673695 [details] [diff] [review]
work around proxy's that don't have a wrapper for their document

Approval Request Comment
[Feature/regressing bug #]:e10s a11y work with windows events
[User impact if declined]:crashes
[Describe test coverage new/current, TreeHerder]:landed m-c so for a while with no known issues
[Risks and why]:  low basically just a null check
[String/UUID change made/needed]: none
Flags: needinfo?(tbsaunde+mozbugs)
Attachment #8673695 - Flags: approval-mozilla-aurora?
Flags: needinfo?(dbolter)
Comment on attachment 8673695 [details] [diff] [review]
work around proxy's that don't have a wrapper for their document

Fix for topcrash, ok on m-c; ok to uplift to aurora.
Attachment #8673695 - Flags: approval-mozilla-aurora? → approval-mozilla-aurora+
You need to log in before you can comment on or make changes to this bug.