Closed Bug 1318725 Opened 3 years ago Closed 3 years ago
Crash in mozalloc
_abort | NS _Debug Break | mozilla::ipc::Logic Error | mozilla::a11y::PDoc Accessible::Transition
This bug was filed from the Socorro interface and is report bp-e73cdb98-2c84-4756-bc56-e69632161118. =============================================================
bilm this doesn't seem to make a lot of sense to me. Presumably we just created a DocAccessibleChild and now want a send a message to its parent, but Transition() is crashing. Its not totally clear to me what can cause Transition() to crash like this. I guess the actor could have been shut down, but as far as I'm aware before that happens DocAccessible::mIPCDoc should get set to null and I'd expect we'd crash before getting here.
This assertion triggers if you try to send a message to an actor that has already been __delete__d. Is there any chance that SendPDocAccessibleConstructor message never gets sent? I see one place where it might not be sent: http://searchfox.org/mozilla-central/source/accessible/base/NotificationController.cpp#861 That's all I can think of here.
(In reply to Bill McCloskey (:billm) from comment #2) > This assertion triggers if you try to send a message to an actor that has > already been __delete__d. Is there any chance that > SendPDocAccessibleConstructor message never gets sent? I see one place where > it might not be sent: > http://searchfox.org/mozilla-central/source/accessible/base/ > NotificationController.cpp#861 > > That's all I can think of here. So aiui the only times tabChild will be null is when a tab is being destroyed. I'd like to believe that in that case DocAccessible::DoInitialUpdate() doesn't get called but without thinking much I guess it might be possible for it to get called so maybe its worth reworking that code to only set DocAccessible::mIPCDoc if we send the ctor message.
This is still showing up on Aurora, e.g. #7 topcrash in Aurora 20161218004028.
This has gone away on Nightly on builds after December 16.
Status: NEW → RESOLVED
Closed: 3 years ago
Resolution: --- → WORKSFORME
Crash volume for signature 'mozalloc_abort | NS_DebugBreak | mozilla::ipc::LogicError | mozilla::a11y::PDocAccessible::Transition': - nightly (version 53): 623 crashes from 2016-11-14. - aurora (version 52): 1597 crashes from 2016-11-14. - beta (version 51): 44 crashes from 2016-11-14. - release (version 50): 46 crashes from 2016-11-01. - esr (version 45): 0 crashes from 2016-07-06. Crash volume on the last weeks (Week N is from 01-02 to 01-08): W. N-1 W. N-2 W. N-3 W. N-4 W. N-5 W. N-6 W. N-7 - nightly 10 16 174 130 149 76 65 - aurora 113 256 254 329 321 303 0 - beta 3 6 4 10 7 6 8 - release 9 2 5 10 11 6 2 - esr 0 0 0 0 0 0 0 Affected platforms: Windows, Linux Crash rank on the last 7 days: Browser Content Plugin - nightly #13 - aurora #1468 #8 - beta #478 - release #1315 - esr
You need to log in before you can comment on or make changes to this bug.