Closed Bug 1336770 Opened 4 years ago Closed 4 years ago

Crash in nsTArray_Impl<T>::IndexOf<T> | mozilla::a11y::ProxyAccessibleBase<T>::ClearChildDoc

Categories

(Core :: Disability Access APIs, defect)

54 Branch
x86
Windows 10
defect
Not set
critical

Tracking

()

RESOLVED FIXED
mozilla54
Tracking Status
firefox52 --- disabled
firefox53 + fixed
firefox54 + fixed

People

(Reporter: alice0775, Assigned: tbsaunde)

References

Details

(Keywords: crash, reproducible, Whiteboard: aes+)

Crash Data

Attachments

(2 files)

Attached file about_support.txt
This bug was filed from the Socorro interface and is 
report bp-567fab6c-6b03-4a73-a841-ddf312170205.
=============================================================

Browser crash.
Reproducible: 80/100 probability

STR
0. I am using ATOK2016 (this triggers a11y)
1. Open http://360.hatenadiary.jp/entry/2016/02/03/194624 in tab[1]
2. Open about:support in a new tab[2]
3. Switch to tab[1]
4. Navigation Back and forward

5. Repeat from step1-
Keywords: reproducible
nightly54.0a1(2017-02-05) bp-595a33ee-9ad5-4612-bbab-736132170205
[Tracking Requested - why for this release]: reproducible crash

nightly54.0a1(2017-02-06) bp-9dd4dea1-87aa-4a93-8d80-387502170206
aurora53.0a2(2017-02-06) bp-44f90428-ffd0-48c3-b857-726202170206
similar crash of Bug 1336093 is still existing.
Flags: needinfo?(mzehe)
Flags: needinfo?(jmathies)
(In reply to Alice0775 White from comment #4)
> similar crash of Bug 1336093 is still existing.

Not for me. Since the backout, the crashes have disappeared for me.
Flags: needinfo?(mzehe)
Flags: needinfo?(jmathies)
Whiteboard: aes+
Depends on: 1326084
I am still hitting this crash regularly including on today's nightly. I'm on a Surface Book Pro. I presume the touchscreen there triggers a11y. I'm also using Microsoft Japanese IME so perhaps that's what's triggering it. Either this bug or bug 1326084, I'm not really sure how they relate.
Tracking 53/54+ for this crash which is easily reproducible for some users.
Assignee: nobody → tbsaunde+mozbugs
I'm not sure if this bug and bug 1333987 are the same, so I'm posting this in both.

I'm also having very frequent crashes with this error, particularly when looking at imdb.com or amazon.co.uk.

I'm running Nightly, and first started getting these crashes in build 20170208030203 on 2017-02-10.

I have quite a few extensions, so I made a new profile and reproduced it there as follows:

1. In the new profile, went to http://www.imdb.com/title/tt3230854/
2. Clicked into season 1 (http://www.imdb.com/title/tt3230854/episodes?season=1&ref_=tt_eps_sn_1).
3. Went back, and clicked on season 2 (http://www.imdb.com/title/tt3230854/episodes?season=2&ref_=tt_eps_sn_2).
4. Repeat this a few times, going from one imdb page to another.
5. Opened a new tab and began typing amazon.co.uk.
--> Crash.

Here's the bug report: bp-804cab2c-99b1-41b1-a752-886062170212

I wasn't actually able to get back into that profile to get the about:support contents, as it crashed everytime whilst loading imdb. Here are those bug reports:

- bp-3e1ffbfa-1f74-486c-a4e6-405fd2170212
- bp-4fc20479-42d3-4ef7-b9a1-7f7332170212
- bp-f5516010-f950-4975-8df0-f48f92170212
- bp-d7ea0753-10fa-464c-ac69-c21362170212

Let me know if there's anything else I can provide that would be helpful.

Thanks! :)
Crash Signature: [@ nsTArray_Impl<T>::IndexOf<T> | mozilla::a11y::ProxyAccessibleBase<T>::ClearChildDoc] → [@ nsTArray_Impl<T>::IndexOf<T> | mozilla::a11y::ProxyAccessibleBase<T>::ClearChildDoc] [@ mozilla::a11y::ProxyAccessibleBase<T>::ClearChildDoc]
(In reply to Emma Stott from comment #10)
> I'm not sure if this bug and bug 1333987 are the same, so I'm posting this
> in both.
> 
> I'm also having very frequent crashes with this error, particularly when
> looking at imdb.com or amazon.co.uk.
> 
> I'm running Nightly, and first started getting these crashes in build
> 20170208030203 on 2017-02-10.
> 
> I have quite a few extensions, so I made a new profile and reproduced it
> there as follows:
> 
> 1. In the new profile, went to http://www.imdb.com/title/tt3230854/
> 2. Clicked into season 1
> (http://www.imdb.com/title/tt3230854/episodes?season=1&ref_=tt_eps_sn_1).
> 3. Went back, and clicked on season 2
> (http://www.imdb.com/title/tt3230854/episodes?season=2&ref_=tt_eps_sn_2).
> 4. Repeat this a few times, going from one imdb page to another.
> 5. Opened a new tab and began typing amazon.co.uk.
> --> Crash.
> 
> Here's the bug report: bp-804cab2c-99b1-41b1-a752-886062170212
> 
> I wasn't actually able to get back into that profile to get the
> about:support contents, as it crashed everytime whilst loading imdb. Here
> are those bug reports:
> 
> - bp-3e1ffbfa-1f74-486c-a4e6-405fd2170212
> - bp-4fc20479-42d3-4ef7-b9a1-7f7332170212
> - bp-f5516010-f950-4975-8df0-f48f92170212
> - bp-d7ea0753-10fa-464c-ac69-c21362170212
> 
> Let me know if there's anything else I can provide that would be helpful.
> 
> Thanks! :)

Are you running software from a company called Actual Tools? If so I'd appreciate you disabling that and trying to reproduce the crash. I'm looking for ways to reproduce the issue locally.
Flags: needinfo?(emmastott)
Mike I think you got this crash by hitting F5 a bunch when a flash video is in the page? I think you use a windows 10 surface right? No assistive tech or IME software involved?
Flags: needinfo?(mhoye)
Surface Book, Windows 10-current, Nightly current. Flash video is playing when I start hitting F5, and I can reproduce at will. I'm happy to turn this machine over to somebody if they want to fix it.
Flags: needinfo?(mhoye)
The crash seems to fix for me on Nightly54.0a1[1].

[1]
https://hg.mozilla.org/mozilla-central/rev/195049fabb7ac5709e5f75614ba630ba3d1b5a9b
Mozilla/5.0 (Windows NT 10.0; WOW64; rv:54.0) Gecko/20100101 Firefox/54.0 ID:20170214030231



Fixed window:
https://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=c27179ee59e9eb226224ec11b907ccce6289fc0c&tochange=62f820d36c917dd3a877e8e8b3489845805cbb4c

The following patch seems to fix the crash.
62f820d36c91	Trevor Saunders — bug 1339128 - reference parent proxy by id r=eeejay

tbsaunde+mozbugs@tbsaunde.org, Is it possible to uplift the fix of bug 1339128 to Aurora53.0a2?
Flags: needinfo?(tbsaunde+mozbugs)
Depends on: 1339128
Good news: I'm not seeing any stacks since build 20170213030206.
I am no longer able to reproduce this per my above method.
Duplicate of this bug: 1338738
Do we know which landing might have fixed this?
Flags: needinfo?(tbsaunde+mozbugs)
Flags: needinfo?(emmastott)
Flags: needinfo?(dbolter)
(In reply to Alice0775 White from comment #14)
> The crash seems to fix for me on Nightly54.0a1[1].
> 
> [1]
> https://hg.mozilla.org/mozilla-central/rev/
> 195049fabb7ac5709e5f75614ba630ba3d1b5a9b
> Mozilla/5.0 (Windows NT 10.0; WOW64; rv:54.0) Gecko/20100101 Firefox/54.0
> ID:20170214030231
> 
> 
> 
> Fixed window:
> https://hg.mozilla.org/integration/mozilla-inbound/
> pushloghtml?fromchange=c27179ee59e9eb226224ec11b907ccce6289fc0c&tochange=62f8
> 20d36c917dd3a877e8e8b3489845805cbb4c
> 
> The following patch seems to fix the crash.
> 62f820d36c91	Trevor Saunders — bug 1339128 - reference parent proxy by id
> r=eeejay
> 
> tbsaunde+mozbugs@tbsaunde.org, Is it possible to uplift the fix of bug
> 1339128 to Aurora53.0a2?

ah, nm, thanks Alice!
Status: NEW → RESOLVED
Closed: 4 years ago
Flags: needinfo?(dbolter)
Resolution: --- → FIXED
Target Milestone: --- → mozilla54
You need to log in before you can comment on or make changes to this bug.