1502061 - Crash in mozilla::a11y::RootAccessible::ProcessDOMEvent

Status: RESOLVED FIXED

(Core :: Disability Access APIs, defect)

Description

[Marcia Knous [:marcia]]

This bug was filed from the Socorro interface and is
report bp-cfe1b62e-4814-45a7-beb1-527840181024.
=============================================================

Seen while looking at nightly crash data - 14 crashes so far. Crashes go back to 64, Build ID 20181013100100: https://bit.ly/2PqRjRi

One comment: XFinity > X1TV > troubleshoot > continue > select a box > crash 

Possible regression range based on Build ID: https://mzl.la/2D5m2NN

Top 10 frames of crashing thread:

0 libxul.so mozilla::a11y::RootAccessible::ProcessDOMEvent mfbt/RefPtr.h:307
1 libxul.so mozilla::a11y::NotificationController::WillRefresh accessible/base/NotificationController.cpp:841
2 libxul.so nsRefreshDriver::Tick layout/base/nsRefreshDriver.cpp:1873
3 libxul.so mozilla::RefreshDriverTimer::TickRefreshDrivers layout/base/nsRefreshDriver.cpp:325
4 libxul.so mozilla::RefreshDriverTimer::Tick layout/base/nsRefreshDriver.cpp:317
5 libxul.so mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::TickRefreshDriver layout/base/nsRefreshDriver.cpp:756
6 libxul.so mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::ParentProcessVsyncNotifier::Run layout/base/nsRefreshDriver.cpp:513
7 libxul.so nsThread::ProcessNextEvent xpcom/threads/nsThread.cpp:1252
8 libxul.so NS_ProcessNextEvent xpcom/threads/nsThreadUtils.cpp:530
9 libxul.so mozilla::ipc::MessagePump::Run ipc/glue/MessagePump.cpp:97

=============================================================

Comment 1

[Marco Zehe (:MarcoZ)]

(In reply to Marcia Knous [:marcia - needinfo? me] from comment #0)
> Possible regression range based on Build ID: https://mzl.la/2D5m2NN

There was unfortunately no accessibility-related change in that range.

Marcia, are these all from Linux, or are there Windows crashes, too? If there are Windows crashes, it would be good to get the info which client invoked accessibility, whether JAWS or NVDA are in there.

Comment 2

[Marcia Knous [:marcia]]

Hi Marco - So far all of the reports are from Android devices.

Comment 3

[Marco Zehe (:MarcoZ)]

Thanks Marcia! Eitan, was this something you worked in recently?

Comment 4

[Marcia Knous [:marcia]]

Fennec 64b3 has 45 crashes/25 installs.

Comment 5

[Marcia Knous [:marcia]]

The regression range in Comment 0 may not be correct - there are some crashes in this signature in Firefox 63 showing up as well.

Comment 6

[Julien Cristau [:jcristau]]

The crashes in 63 are from windows, so maybe something different.

Comment 7

[Eitan Isaacson [:eeejay]]

Attachment: Check if origTargetNode still exists in ProcessDOMEvent. r?Jamie

Comment 8

[Eitan Isaacson [:eeejay]]

The windows stack seems to point to this. Not sure why this is showing up more on Android though.

Let's see if this abates the crash.

Comment 9

[James Teh [:Jamie]]

Comment on attachment 9028696 [details] [diff] [review]
Check if origTargetNode still exists in ProcessDOMEvent. r?Jamie

Makes sense. Let's hope it works!

Comment 10

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/c957f8352e83
Check if origTargetNode still exists in ProcessDOMEvent. r=Jamie

Comment 11

[Noemi Erli[:noemi_erli]]

https://hg.mozilla.org/mozilla-central/rev/c957f8352e83

Comment 12

[Ryan VanderMeulen [:RyanVM]]

No crashes on Beta65 so far.