Crash in PLDHashTable::Add | mozilla::a11y::AccessibleWrap::GetChildIDFor

NEW
Unassigned

Status

()

Core
Disability Access APIs
P3
critical
2 years ago
5 months ago

People

(Reporter: kar, Unassigned)

Tracking

({crash, reproducible})

unspecified
x86
Windows 10
crash, reproducible
Points:
---

Firefox Tracking Flags

(firefox48 affected, firefox49 affected, firefox50 affected, firefox51 affected)

Details

(Whiteboard: a11y:crash-ipc, crash signature)

(Reporter)

Description

2 years ago
This bug was filed from the Socorro interface and is 
report bp-b02dbe3c-72b1-4df2-964c-b54942160510.
=============================================================

Reporting this as Firefox just crashed on me. I was writing a comment in a text field in Aha. I have many tabs open, including GDocs (although not doing anything with them at the time).

I'm on a Windows 10 machine, X1 carbon touch. I'm running nightly, and I just checked - says I'm up to date (49.0a1 2016-05-10)

I'm also not positive if I've added this to the right bugzilla component! The crash report gave me a few different options, so I've just chosen one!
Crash volume for signature 'PLDHashTable::Add | mozilla::a11y::AccessibleWrap::GetChildIDFor':
 - nightly (version 50): 2 crashes from 2016-06-06.
 - aurora  (version 49): 22 crashes from 2016-06-07.
 - beta    (version 48): 30 crashes from 2016-06-06.
 - release (version 47): 0 crash from 2016-05-31.
 - esr     (version 45): 0 crash from 2016-04-07.

Crash volume on the last weeks:
             Week N-1   Week N-2   Week N-3   Week N-4   Week N-5   Week N-6   Week N-7
 - nightly          0          0          0          1          0          0          0
 - aurora           1          2          5          4          4          6          0
 - beta             2          3          0          3          2         12          5
 - release          0          0          0          0          0          0          0
 - esr              0          0          0          0          0          0          0

Affected platform: Windows
status-firefox48: --- → affected
status-firefox49: --- → affected
status-firefox50: --- → affected

Comment 2

2 years ago
https://hg.mozilla.org/mozilla-central/rev/e78975b53563d80c99ebfbdf8a9fbf6b829a8a48
Mozilla/5.0 (Windows NT 10.0; WOW64; rv:51.0) Gecko/20100101 Firefox/51.0 ID:20160808030441

I encounter crash on Nightly51.0a1 when I test Bug 1293252 Comment#3.

STR
1. Force enable e10s (because, e10s is default disabled due to accessibility)
2. Open the link in background tab (it is a more reproducible if you open the link in 3-5 tabs)
  http://www.cracked.com/article_20276_5-famous-kids-characters-you-didnt-know-were-propaganda.html.

Actual Results:
Browser will crash(probability 50/50)

bp-6914d391-d350-4258-b9e8-50c462160808
bp-71391017-d9ef-4fab-83b3-32f192160808
bp-35ad77fe-3a14-4f59-a43d-c5ff32160808

and different sig.
bp-397b6a48-bd9a-46f2-a70c-3afb42160808
bp-e071feb4-41c3-40d1-b8bc-717d12160808
bp-9bf0ee96-0722-41ca-9df8-2257d2160808

Updated

2 years ago
status-firefox51: --- → affected

Updated

2 years ago
Has STR: --- → yes
Keywords: reproducible
Component: General → Disability Access APIs
So, it looks like FireWinEvent() is called on an accessible where IsProxy() returns true, but DocProxyWrapper() does not.  That would seem to imply either Proxy() returned null, or Proxy()->Document() was null, but neither of those should ever happen.
low volume crash, 2 crashes on 57, all other are >=50
Priority: -- → P3
Whiteboard: a11y:crash-ipc
You need to log in before you can comment on or make changes to this bug.