Crash in IPCError-browser | PDocAccessibleParent::RecvBindChildDoc

RESOLVED FIXED in Firefox 53

Status

()

Core
Disability Access APIs
--
critical
RESOLVED FIXED
2 years ago
a year ago

People

(Reporter: marcia, Assigned: tbsaunde)

Tracking

({crash})

Trunk
mozilla53
Unspecified
Windows 7
crash
Points:
---

Firefox Tracking Flags

(firefox53 fixed)

Details

(crash signature)

Attachments

(1 attachment)

This bug was filed from the Socorro interface and is 
report bp-784809ae-83b3-418c-a18e-f20a62170115.
=============================================================

Seen while looking at nightly crash stats: http://bit.ly/2iufOs1

Crashes started in 20170114030206 build.  Possible regression range: https://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=91f5293e9a89056565493ed5073c3842b0ee9fdc&tochange=ac3275723df59db0f09198fdb61b51e7002c391a
#4 topcrash in Nightly 20170113030227, with 53 occurrences.

davidb, it's another a11y crash.
Flags: needinfo?(dbolter)
Component: Layout → Disability Access APIs
Flags: needinfo?(dbolter)
(Assignee)

Comment 2

2 years ago
Created attachment 8828098 [details] [diff] [review]
annotate some IPC failure conditions
Attachment #8828098 - Flags: review?(eitan)
Comment on attachment 8828098 [details] [diff] [review]
annotate some IPC failure conditions

Review of attachment 8828098 [details] [diff] [review]:
-----------------------------------------------------------------

Assuming this is just to put in some probes for a followup fix?

Looks good. One query below. Thanks for sending reviews my way. Trying to catch up..

::: accessible/ipc/DocAccessibleParent.cpp
@@ +378,5 @@
>  
>    MOZ_DIAGNOSTIC_ASSERT(CheckDocTree());
>  
>    auto childDoc = static_cast<DocAccessibleParent*>(aChildDoc);
>    childDoc->Unbind();

Any chance aChildDoc is null? Dereferencing it here can also be causing a crash. No?
Attachment #8828098 - Flags: review?(eitan) → review+
(Assignee)

Comment 4

2 years ago
> ::: accessible/ipc/DocAccessibleParent.cpp
> @@ +378,5 @@
> >  
> >    MOZ_DIAGNOSTIC_ASSERT(CheckDocTree());
> >  
> >    auto childDoc = static_cast<DocAccessibleParent*>(aChildDoc);
> >    childDoc->Unbind();
> 
> Any chance aChildDoc is null? Dereferencing it here can also be causing a
> crash. No?

no, ipdl wants you to mark actor arguments as nullable if they can be null and this one isn't.  In any case that would be invalid for the child to send, and I don't think I've ever seen a crash there.

Comment 5

2 years ago
Pushed by tsaunders@mozilla.com:
https://hg.mozilla.org/integration/mozilla-inbound/rev/e28612e9fdb8
annotate some IPC failure conditions r=eeejay

Comment 6

2 years ago
bugherder
https://hg.mozilla.org/mozilla-central/rev/e28612e9fdb8
Status: NEW → RESOLVED
Last Resolved: 2 years ago
status-firefox53: affected → fixed
Resolution: --- → FIXED
Target Milestone: --- → mozilla53
(Assignee)

Updated

2 years ago
Status: RESOLVED → REOPENED
Resolution: FIXED → ---
Bug 1332690 shows a more informative crash.
Status: REOPENED → RESOLVED
Last Resolved: 2 years ago2 years ago
Resolution: --- → DUPLICATE
Duplicate of bug: 1332690
Per comment #6, other issues and followups should be tracked in new bugs.
Resolution: DUPLICATE → FIXED
You need to log in before you can comment on or make changes to this bug.