1574286 - [fission] Crash in [@ IPCError-browser | AddChildDoc binding to nonexistant proxy!]

Status: RESOLVED FIXED

(Core :: Disability Access APIs, defect, P2)

Description

[Andrew McCreight (out of office until 8/21) [:mccr8]]

This bug is for crash report bp-8339bfbc-221e-4763-8d43-89bb70190812.

Top 10 frames of crashing thread:

0 ntdll.dll NtWaitForAlertByThreadId 
1 ntdll.dll RtlSleepConditionVariableSRW 
2 kernelbase.dll SleepConditionVariableSRW 
3 mozglue.dll mozilla::detail::ConditionVariableImpl::wait mozglue/misc/ConditionVariable_windows.cpp:50
4 xul.dll struct already_AddRefed<nsIRunnable> mozilla::ThreadEventQueue<mozilla::PrioritizedEventQueue>::GetEvent xpcom/threads/ThreadEventQueue.cpp:153
5 xul.dll nsThread::ProcessNextEvent xpcom/threads/nsThread.cpp:1134
6 xul.dll NS_ProcessNextEvent xpcom/threads/nsThreadUtils.cpp:486
7 xul.dll mozilla::ipc::MessagePump::Run ipc/glue/MessagePump.cpp:110
8 xul.dll MessageLoop::RunHandler ipc/chromium/src/base/message_loop.cc:308
9 xul.dll MessageLoop::Run ipc/chromium/src/base/message_loop.cc:290

This looks like a new crash in Nightly. 14 crashes from 9 installations, which isn't super high volume, but seems pretty high volume for an a11y crash. One of the user comments is " fission???", and indeed all of these crash reports have Fission enabled.

Comment 1

[James Teh [:Jamie]]

Attachment: Bug 1574286: When adding a remote child document, if the parent proxy doesn't exist yet, defer adding until it does.

For OOP iframes, sometimes, AddChildDoc gets called before the embedder sends us the OuterDocAccessible.
Previously, we crashed when this occurred.
Now, we add the child when the OuterDocAccessible proxy gets created later.

Comment 2

[James Teh [:Jamie]]

Note that I haven't seen this crash myself, but I'm hoping this fix will deal with it.

Comment 3

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/952b14eb6ea3
When adding a remote child document, if the parent proxy doesn't exist yet, defer adding until it does. r=eeejay

Comment 4

[Stefan Hindli [:stefan_hindli]]

https://hg.mozilla.org/mozilla-central/rev/952b14eb6ea3

Comment 5

[Bogdan Tara[:bogdan_tara | bogdant]]

https://hg.mozilla.org/releases/mozilla-beta/rev/952b14eb6ea3

Comment 6

[Chris Peterson [:cpeterson]]

Retroactively moving fixed bugs whose summaries mention "Fission" (or other Fission-related keywords) but are not assigned to a Fission Milestone to an appropriate Fission Milestone.

This will generate a lot of bugmail, so you can filter your bugmail for the following UUID and delete them en masse:

0ee3c76a-bc79-4eb2-8d12-05dc0b68e732