1311748 - Crash in mozilla::mscom::MainThreadHandoff::OnWalkInterface

Status: RESOLVED FIXED

(Core :: IPC, defect)

Description

[David Bolter [:davidb] (NeedInfo me for attention)]

This bug was filed from the Socorro interface and is 
report bp-0bc5418d-ac77-48bc-8699-45e692161020.
=============================================================

More here: https://crash-stats.mozilla.com/signature/?product=Firefox&signature=mozilla%3A%3Amscom%3A%3AMainThreadHandoff%3A%3AOnWalkInterface&date=%3E%3D2016-10-13T17%3A05%3A00.000Z&date=%3C2016-10-20T17%3A05%3A00.000Z&_columns=date&_columns=product&_columns=version&_columns=build_id&_columns=platform&_columns=reason&_columns=address&_sort=-date&page=1#reports

Comment 1

[David Bolter [:davidb] (NeedInfo me for attention)]

Aaron ping.

Comment 2

[(No longer employed by Mozilla) Aaron Klotz]

According to that first crash report, we blew up while processing the result of IAccessible2::get_relations. There might be some problems with the code that resolves that array.

Comment 4

[James Teh [:Jamie]]

I'm seeing this constantly in 52.0a1 (2016-11-02) (32-bit). STR:
1. With NVDA running, open any page. This will do: data:text/html,a
2. Wait about a second.
Crash!

Reports:
bp-95eba00e-88a1-44aa-bf6d-ec4c82161102
bp-13038116-6bc3-448e-ac1f-26a302161102
bp-b7a24606-fbc7-4976-867b-e09dc2161102
... Plenty more where those came from. :)

Comment 5

[James Teh [:Jamie]]

And... now it's behaving.

These seemed to be caused by having AccProbe running... but I wasn't actually doing anything (no event monitoring, etc.) in AccProbe; I just left it running. As soon as I exit AccProbe, it behaves. If I start AccProbe again, bam! Crashes.

Comment 6

[(No longer employed by Mozilla) Aaron Klotz]

Attachment: Bug 1311748: Remove extra pointer dereference from MainThreadHandoff::FixArrayElements;

Review commit: https://reviewboard.mozilla.org/r/90448/diff/#index_header
See other reviews: https://reviewboard.mozilla.org/r/90448/

Comment 7

[Jim Mathies [:jimm]]

Comment on attachment 8807225 [details]
Bug 1311748: Remove extra pointer dereference from MainThreadHandoff::FixArrayElements;

https://reviewboard.mozilla.org/r/90448/#review90218

Comment 8

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/58eb286fe327
Remove extra pointer dereference from MainThreadHandoff::FixArrayElements; r=jimm

Comment 9

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/58eb286fe327