Closed Bug 1502061 Opened 1 year ago Closed 1 year ago

Crash in mozilla::a11y::RootAccessible::ProcessDOMEvent

Categories

(Core :: Disability Access APIs, defect, critical)

Unspecified
Android
defect
Not set
critical

Tracking

()

RESOLVED FIXED
mozilla65
Tracking Status
firefox-esr60 --- unaffected
firefox63 --- unaffected
firefox64 --- wontfix
firefox65 --- fixed

People

(Reporter: marcia, Assigned: eeejay)

Details

(Keywords: crash, csectype-nullptr, regression)

Crash Data

Attachments

(1 file)

This bug was filed from the Socorro interface and is
report bp-cfe1b62e-4814-45a7-beb1-527840181024.
=============================================================

Seen while looking at nightly crash data - 14 crashes so far. Crashes go back to 64, Build ID 20181013100100: https://bit.ly/2PqRjRi

One comment: XFinity > X1TV > troubleshoot > continue > select a box > crash 

Possible regression range based on Build ID: https://mzl.la/2D5m2NN

Top 10 frames of crashing thread:

0 libxul.so mozilla::a11y::RootAccessible::ProcessDOMEvent mfbt/RefPtr.h:307
1 libxul.so mozilla::a11y::NotificationController::WillRefresh accessible/base/NotificationController.cpp:841
2 libxul.so nsRefreshDriver::Tick layout/base/nsRefreshDriver.cpp:1873
3 libxul.so mozilla::RefreshDriverTimer::TickRefreshDrivers layout/base/nsRefreshDriver.cpp:325
4 libxul.so mozilla::RefreshDriverTimer::Tick layout/base/nsRefreshDriver.cpp:317
5 libxul.so mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::TickRefreshDriver layout/base/nsRefreshDriver.cpp:756
6 libxul.so mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::ParentProcessVsyncNotifier::Run layout/base/nsRefreshDriver.cpp:513
7 libxul.so nsThread::ProcessNextEvent xpcom/threads/nsThread.cpp:1252
8 libxul.so NS_ProcessNextEvent xpcom/threads/nsThreadUtils.cpp:530
9 libxul.so mozilla::ipc::MessagePump::Run ipc/glue/MessagePump.cpp:97

=============================================================
(In reply to Marcia Knous [:marcia - needinfo? me] from comment #0)
> Possible regression range based on Build ID: https://mzl.la/2D5m2NN

There was unfortunately no accessibility-related change in that range.

Marcia, are these all from Linux, or are there Windows crashes, too? If there are Windows crashes, it would be good to get the info which client invoked accessibility, whether JAWS or NVDA are in there.
Flags: needinfo?(mozillamarcia.knous)
Hi Marco - So far all of the reports are from Android devices.
Flags: needinfo?(mozillamarcia.knous)
Thanks Marcia! Eitan, was this something you worked in recently?
Flags: needinfo?(eitan)
Fennec 64b3 has 45 crashes/25 installs.
The regression range in Comment 0 may not be correct - there are some crashes in this signature in Firefox 63 showing up as well.
The crashes in 63 are from windows, so maybe something different.
Flags: needinfo?(jteh)
The windows stack seems to point to this. Not sure why this is showing up more on Android though.

Let's see if this abates the crash.
Flags: needinfo?(eitan)
Comment on attachment 9028696 [details] [diff] [review]
Check if origTargetNode still exists in ProcessDOMEvent. r?Jamie

Makes sense. Let's hope it works!
Flags: needinfo?(jteh)
Attachment #9028696 - Flags: review?(jteh) → review+
Keywords: checkin-needed
Pushed by rmaries@mozilla.com:
https://hg.mozilla.org/integration/mozilla-inbound/rev/c957f8352e83
Check if origTargetNode still exists in ProcessDOMEvent. r=Jamie
Keywords: checkin-needed
https://hg.mozilla.org/mozilla-central/rev/c957f8352e83
Status: NEW → RESOLVED
Closed: 1 year ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla65
No crashes on Beta65 so far.
You need to log in before you can comment on or make changes to this bug.