Open Bug 1516236 Opened 1 year ago Updated 1 year ago

Crash in mozilla::a11y::TreeMutation::BeforeRemoval


(Core :: Disability Access APIs, defect, P3, critical)

Windows 10




(Reporter: gsvelto, Unassigned)


(Keywords: crash)

Crash Data

This bug was filed from the Socorro interface and is
report bp-e3f704fe-2288-4140-83de-a6bf40181224.

Top 10 frames of crashing thread:

0 xul.dll mozilla::a11y::TreeMutation::BeforeRemoval accessible/base/EventTree.cpp:86
1 xul.dll mozilla::a11y::DocAccessible::ContentRemoved accessible/generic/DocAccessible.cpp:1820
2 xul.dll mozilla::a11y::DocAccessible::ContentRemoved accessible/generic/DocAccessible.cpp:1849
3 xul.dll mozilla::a11y::DocAccessible::RecreateAccessible accessible/generic/DocAccessible.cpp:1252
4 xul.dll nsPluginFrame::PrepForDrawing layout/generic/nsPluginFrame.cpp:344
5 xul.dll nsPluginInstanceOwner::CreateWidget dom/plugins/base/nsPluginInstanceOwner.cpp:2864
6 xul.dll nsPluginHost::InstantiatePluginInstance dom/plugins/base/nsPluginHost.cpp:783
7 xul.dll nsresult nsObjectLoadingContent::InstantiatePluginInstance dom/base/nsObjectLoadingContent.cpp:708
8 xul.dll nsObjectLoadingContent::SyncStartPluginInstance dom/base/nsObjectLoadingContent.cpp:2792
9 xul.dll class nsNPAPIPluginInstance* nsObjectLoadingContent::ScriptRequestPluginInstance dom/base/nsObjectLoadingContent.cpp:2763


Not very high volume but the stacks are very consistent across versions so it's probably a valid issues. It looks like a NULL-pointer dereference since the address is always the same and close to zero and looking at the stack it's probably triggerered by plugins. The few crash URLs that have been reported seem to include video elements, possibly Flash-based.
Priority: -- → P3
You need to log in before you can comment on or make changes to this bug.