1360122 - Crash in mozilla::a11y::DocAccessible::ContentRemoved

Status: RESOLVED DUPLICATE of bug 1363027

(Core :: Disability Access APIs, defect)

Description

[Calixte Denizet (:calixte)]

This bug was filed from the Socorro interface and is 
report bp-0fde084d-4150-4408-94e9-14a390170426.
=============================================================

There are 37 crashes in nightly 55 with buildid 20170426030329. In analyzing the backtrace, the regression may have been introduced by patch [1] to fix bug 1353094.

[1] https://hg.mozilla.org/mozilla-central/rev?node=7636849e6f5829175bc06af8b81051ac7b61a687

Comment 1

[David Bolter [:davidb] (NeedInfo me for attention)]

Thanks Calixte. Adding Alex to NI.

Comment 2

[alexander :surkov (:asurkov)]

Seems to be another broken tree thing, since aContent->Parent() doesn't assert. I have an idea that I'm going to try withing next few/several days, that hopefully will help here, but I'd be nice to have a str for sure.

Comment 3

[Calixte Denizet (:calixte)]

This signature is ranked #4 in topcrashers (81 crashes) and it's a startup crash.

Comment 4

[alexander :surkov (:asurkov)]

most of the crashes are for an accessible node [1] triggered by nsAccessibilityService::ContentRemoved. Before bug 1353094 we did mostly same thing [2], i.e. grabbed an accessible object for a child node, and then its parent accessible [3].

also, 0x0 crash address looks confusing, as accessible->GetParent() was null.

Is anyone around who could check these findings, in case if I miss something evident?

[1] https://hg.mozilla.org/mozilla-central/annotate/0b77ed3f26c5/accessible/generic/DocAccessible.cpp#l1994
[2] https://hg.mozilla.org/mozilla-central/rev?node=7636849e6f5829175bc06af8b81051ac7b61a687#l5.70
[3] https://hg.mozilla.org/mozilla-central/rev?node=7636849e6f5829175bc06af8b81051ac7b61a687#l4.45

Comment 5

[Nicholas Nethercote [inactive]]

#6 Windows topcrash in Nightly 20170428030259.

Comment 6

[David Bolter [:davidb] (NeedInfo me for attention)]

(In reply to alexander :surkov from comment #4)
 
> Is anyone around who could check these findings, in case if I miss something
> evident?

Is aChildNode null?

Comment 7

[alexander :surkov (:asurkov)]

(In reply to David Bolter [:davidb] from comment #6)
> (In reply to alexander :surkov from comment #4)
>  
> > Is anyone around who could check these findings, in case if I miss something
> > evident?
> 
> Is aChildNode null?

nsCSSFrameConstructor::ContentRemoved shouldn't call us with null I believe. Anyway, GetAccessible() should return null for a null node.

Comment 8

[alexander :surkov (:asurkov)]

appears to be fixed by bug 1362063, no crashes after May 4, let's wait for couple days more before calling it done.

Comment 9

[alexander :surkov (:asurkov)]

(In reply to alexander :surkov from comment #8)
> appears to be fixed by bug 1362063, no crashes after May 4, let's wait for
> couple days more before calling it done.

this bug just got another signature, bug 1363027, marking as dupe