Closed Bug 1318725 Opened 3 years ago Closed 3 years ago

Crash in mozalloc_abort | NS_DebugBreak | mozilla::ipc::LogicError | mozilla::a11y::PDocAccessible::Transition

Categories

(Core :: Disability Access APIs, defect, critical)

Unspecified
Windows
defect
Not set
critical

Tracking

()

RESOLVED WORKSFORME
Tracking Status
firefox50 --- affected
firefox51 --- affected
firefox52 --- affected
firefox53 --- affected

People

(Reporter: aklotz, Unassigned)

References

Details

(Keywords: crash)

Crash Data

This bug was filed from the Socorro interface and is 
report bp-e73cdb98-2c84-4756-bc56-e69632161118.
=============================================================
bilm this doesn't seem to make a lot of sense to me.  Presumably we just created a DocAccessibleChild and now want a send a message to its parent, but Transition() is crashing.  Its not totally clear to me what can cause Transition() to crash like this.  I guess the actor could have been shut down, but as far as I'm aware before that happens DocAccessible::mIPCDoc should get set to null and I'd expect we'd crash before getting here.
Flags: needinfo?(wmccloskey)
This assertion triggers if you try to send a message to an actor that has already been __delete__d. Is there any chance that SendPDocAccessibleConstructor message never gets sent? I see one place where it might not be sent:
http://searchfox.org/mozilla-central/source/accessible/base/NotificationController.cpp#861

That's all I can think of here.
Flags: needinfo?(wmccloskey)
(In reply to Bill McCloskey (:billm) from comment #2)
> This assertion triggers if you try to send a message to an actor that has
> already been __delete__d. Is there any chance that
> SendPDocAccessibleConstructor message never gets sent? I see one place where
> it might not be sent:
> http://searchfox.org/mozilla-central/source/accessible/base/
> NotificationController.cpp#861
> 
> That's all I can think of here.

So aiui the only times tabChild will be null is when a tab is being destroyed.  I'd like to believe that in that case DocAccessible::DoInitialUpdate() doesn't get called but without thinking much I guess it might be possible for it to get called so maybe its worth reworking that code to only set DocAccessible::mIPCDoc if we send the ctor message.
Duplicate of this bug: 1323364
This is still showing up on Aurora, e.g. #7 topcrash in Aurora 20161218004028.
This has gone away on Nightly on builds after December 16.
Status: NEW → RESOLVED
Closed: 3 years ago
Resolution: --- → WORKSFORME
Crash volume for signature 'mozalloc_abort | NS_DebugBreak | mozilla::ipc::LogicError | mozilla::a11y::PDocAccessible::Transition':
 - nightly (version 53): 623 crashes from 2016-11-14.
 - aurora  (version 52): 1597 crashes from 2016-11-14.
 - beta    (version 51): 44 crashes from 2016-11-14.
 - release (version 50): 46 crashes from 2016-11-01.
 - esr     (version 45): 0 crashes from 2016-07-06.

Crash volume on the last weeks (Week N is from 01-02 to 01-08):
            W. N-1  W. N-2  W. N-3  W. N-4  W. N-5  W. N-6  W. N-7
 - nightly      10      16     174     130     149      76      65
 - aurora      113     256     254     329     321     303       0
 - beta          3       6       4      10       7       6       8
 - release       9       2       5      10      11       6       2
 - esr           0       0       0       0       0       0       0

Affected platforms: Windows, Linux

Crash rank on the last 7 days:
           Browser   Content   Plugin
 - nightly           #13
 - aurora  #1468     #8
 - beta              #478
 - release           #1315
 - esr
You need to log in before you can comment on or make changes to this bug.