Crash in mozilla::dom::Element::GetAttr

RESOLVED FIXED in Firefox 66

Status

()

defect
P1
critical
RESOLVED FIXED
4 months ago
3 months ago

People

(Reporter: philipp, Assigned: MarcoZ)

Tracking

({crash, regression})

66 Branch
mozilla67
All
Windows
Points:
---
Dependency tree / graph

Firefox Tracking Flags

(firefox-esr60 unaffected, firefox65 unaffected, firefox66 fixed, firefox67 fixed)

Details

(crash signature)

Attachments

(1 attachment)

Reporter

Description

4 months ago

This bug is for crash report bp-441e0b9f-7a7a-47dd-8c57-ca8240190206.

Top 10 frames of crashing thread:

0 xul.dll mozilla::dom::Element::GetAttr dom/base/Element.cpp:2684
1 xul.dll mozilla::a11y::XULMenuitemAccessible::AccessKey accessible/xul/XULMenuAccessible.cpp:146
2 xul.dll mozilla::a11y::XULMenuitemAccessibleWrap::get_accKeyboardShortcut accessible/windows/msaa/XULMenuAccessibleWrap.cpp:49
3 oleacc.dll AccWrap_Base::get_accKeyboardShortcut 
4 oleacc.dll AccWrap_Annotate::get_accKeyboardShortcut 
5 uiautomationcore.dll AccUtils::get_accStringProp 
6 uiautomationcore.dll MsaaProxy::GetPropertyValue 
7 uiautomationcore.dll UiaNode::ProviderGetPropertyValue 
8 uiautomationcore.dll InProcClientAPIStub::InvokeInProcAPI 
9 uiautomationcore.dll UiaNode::CrossProcess_GetPropertyValues 

the crash signature is spiking up in firefox 66.0b builds (~.6% of browser crashes) - perhaps related to the changes in bug 1510476?

Reporter

Updated

3 months ago
Component: Audio/Video: GMP → Disability Access APIs

Comment 1

3 months ago

XULMenuAccessibleWrap::get_accKeyboardShortcut needs a defunct check. (The base implementation doesn't check defunct directly because it calls ResolveChild which handles that.)

Priority: -- → P1
Assignee: nobody → mzehe
Status: NEW → ASSIGNED

Comment 3

3 months ago
Pushed by mzehe@mozilla.com:
https://hg.mozilla.org/integration/autoland/rev/9f0d85143372
Make sure a XULMenuItemAccessibleWrap is not going away when creating its keyboard shortcut info, r=Jamie

Comment 4

3 months ago
bugherder
Status: ASSIGNED → RESOLVED
Last Resolved: 3 months ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla67
Reporter

Comment 5

3 months ago

thanks for the quick patch! it's looking very contained - could you request an uplift to beta please?

Flags: needinfo?(mzehe)

Comment on attachment 9042016 [details]
Bug 1525546 - Make sure a XULMenuItemAccessibleWrap is not going away when creating its keyboard shortcut info, r=Jamie

Beta/Release Uplift Approval Request

Feature/Bug causing the regression

Bug 1510476

User impact if declined

Crash.

Is this code covered by automated tests?

No

Has the fix been verified in Nightly?

Yes

Needs manual test from QE?

No

If yes, steps to reproduce

List of other uplifts needed

None

Risk to taking this patch

Low

Why is the change risky/not risky? (and alternatives if risky)

defunct/null check.

String changes made/needed

None.

Flags: needinfo?(mzehe)
Attachment #9042016 - Flags: approval-mozilla-beta?

Comment on attachment 9042016 [details]
Bug 1525546 - Make sure a XULMenuItemAccessibleWrap is not going away when creating its keyboard shortcut info, r=Jamie

Crash fix, ok to uplift for beta 7.

Attachment #9042016 - Flags: approval-mozilla-beta? → approval-mozilla-beta+
You need to log in before you can comment on or make changes to this bug.