1426062 - PROCESS-CRASH | message-header | application crashed [@ mozilla::a11y::XULListboxAccessible::NativeRole] (Thunderbird Linux only)

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, defect)

Description

[Jorg K (CEST = GMT+2)]

PROCESS-CRASH | message-header | application crashed [@ mozilla::a11y::XULListboxAccessible::NativeRole]

On TC runs this appears on Mozmill "Z2".

First seen Sat Dec 9, 2017, 00:06:53:
https://treeherder.mozilla.org/#/jobs?repo=comm-central&revision=da594b621ed067a5dd190426ec0ad8220186cce3

M-C last good: c35272ba2006ecc8bc10099242f7b4c5c0
M-C first bad: 5f52c2488a831edbc33fa0bc6003ed4df9

https://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=c35272ba2006ecc8bc10099242f7b4c5c0&tochange=5f52c2488a831edbc33fa0bc6003ed4df9

Sorry, I missed that back then since it drowned in other test failures.

Maybe related to bug 1422465.

Brian and Alexander, is this related to your changes?
Aceman, does that crash locally?

From https://public-artifacts.taskcluster.net/Q15NqEc9RZenFjsdNmyKBQ/0/public/logs/live_backing.log it appears to crash running
test-reply-identity.js | test_reply_no_matching_identity

That log also contains other errors and a crash stack.

Comment 1

[Brian Grinstead [:bgrins]]

We did make a minor change to that function in Bug 1422465: https://hg.mozilla.org/mozilla-central/rev/319fbe5fff76#l2.30. Looking at it, if mContent->GetParent() is null that would be a problem.. does updating the condition to `(mContent->GetParent() && mContent->GetParent()->IsXULElement(nsGkAtoms::panel))` prevent the crash?

Comment 2

[Jorg K (CEST = GMT+2)]

Aceman would have to try this on Linux.

Comment 3

[:aceman]

Unfortunately I do not get the crash locally (Linu64 debug).

Comment 4

[Jorg K (CEST = GMT+2)]

OK, here's s try run with that change:
https://treeherder.mozilla.org/#/jobs?repo=try-comm-central&revision=6cbf40ad40fd609c03f4c24f43d600d5c41a5913
If it comes out green, then the suggestion helped.

Comment 5

[Jorg K (CEST = GMT+2)]

Silly me, I should have done an opt run, so here we go again:
https://hg.mozilla.org/try-comm-central/rev/e195df43ccb268e01b2961af1a38a38fd2340800
There was an M-C merge in the meantime, so fingers crossed it still builds.

Comment 6

[Jorg K (CEST = GMT+2)]

Attachment: mozilla-1426062.patch

Brian, this fixes the crash for us. I've attached the change that you suggested.

Of course you're the author, so maybe you want to change the patch to reflect this and have it reviewed by Alexander.

Comment 7

[alexander :surkov (:asurkov)]

Comment on attachment 8937926 [details] [diff] [review]
mozilla-1426062.patch

Review of attachment 8937926 [details] [diff] [review]:
-----------------------------------------------------------------

Stealing review request from Brian. Accessible object's content may not not have a parent during accessible object destruction.

::: accessible/xul/XULListboxAccessible.cpp
@@ +155,5 @@
>  XULListboxAccessible::NativeRole()
>  {
>    // A richlistbox is used with the new autocomplete URL bar, and has a parent
>    // popup <panel>.
> +  if (mContent->GetParent() && mContent->GetParent()->IsXULElement(nsGkAtoms::panel))

It looks right

Comment 8

[Brian Grinstead [:bgrins]]

Works for me, thanks all!

Comment 9

[Jorg K (CEST = GMT+2)]

Dear sheriff, please change r=bgrins to r=surkov before landing.

Comment 10

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/2e5458ec951f
Follow-up for bug 1422465: check parent before dereferencing it. r=surkov

Comment 11

[Natalia Csoregi [:nataliaCs]]

https://hg.mozilla.org/mozilla-central/rev/2e5458ec951f