1516236 - Crash in mozilla::a11y::TreeMutation::BeforeRemoval

Status: RESOLVED WORKSFORME

(Core :: Disability Access APIs, defect, P3)

Description

[Gabriele Svelto [:gsvelto]]

This bug was filed from the Socorro interface and is
report bp-e3f704fe-2288-4140-83de-a6bf40181224.
=============================================================

Top 10 frames of crashing thread:

0 xul.dll mozilla::a11y::TreeMutation::BeforeRemoval accessible/base/EventTree.cpp:86
1 xul.dll mozilla::a11y::DocAccessible::ContentRemoved accessible/generic/DocAccessible.cpp:1820
2 xul.dll mozilla::a11y::DocAccessible::ContentRemoved accessible/generic/DocAccessible.cpp:1849
3 xul.dll mozilla::a11y::DocAccessible::RecreateAccessible accessible/generic/DocAccessible.cpp:1252
4 xul.dll nsPluginFrame::PrepForDrawing layout/generic/nsPluginFrame.cpp:344
5 xul.dll nsPluginInstanceOwner::CreateWidget dom/plugins/base/nsPluginInstanceOwner.cpp:2864
6 xul.dll nsPluginHost::InstantiatePluginInstance dom/plugins/base/nsPluginHost.cpp:783
7 xul.dll nsresult nsObjectLoadingContent::InstantiatePluginInstance dom/base/nsObjectLoadingContent.cpp:708
8 xul.dll nsObjectLoadingContent::SyncStartPluginInstance dom/base/nsObjectLoadingContent.cpp:2792
9 xul.dll class nsNPAPIPluginInstance* nsObjectLoadingContent::ScriptRequestPluginInstance dom/base/nsObjectLoadingContent.cpp:2763

=============================================================

Not very high volume but the stacks are very consistent across versions so it's probably a valid issues. It looks like a NULL-pointer dereference since the address is always the same and close to zero and looking at the stack it's probably triggerered by plugins. The few crash URLs that have been reported seem to include video elements, possibly Flash-based.

Comment 1

[BugBot [:suhaib / :marco/ :calixte]]

Closing because no crashes reported for 12 weeks.