Closed Bug 1574286 Opened 5 months ago Closed 5 months ago

[fission] Crash in [@ IPCError-browser | AddChildDoc binding to nonexistant proxy!]


(Core :: Disability Access APIs, defect, P2, critical)

Windows 10



Fission Milestone M4
Tracking Status
firefox-esr60 --- unaffected
firefox-esr68 --- unaffected
firefox69 --- unaffected
firefox70 --- fixed


(Reporter: mccr8, Assigned: Jamie)


(Blocks 2 open bugs)


(Keywords: crash)

Crash Data


(1 file)

This bug is for crash report bp-8339bfbc-221e-4763-8d43-89bb70190812.

Top 10 frames of crashing thread:

0 ntdll.dll NtWaitForAlertByThreadId 
1 ntdll.dll RtlSleepConditionVariableSRW 
2 kernelbase.dll SleepConditionVariableSRW 
3 mozglue.dll mozilla::detail::ConditionVariableImpl::wait mozglue/misc/ConditionVariable_windows.cpp:50
4 xul.dll struct already_AddRefed<nsIRunnable> mozilla::ThreadEventQueue<mozilla::PrioritizedEventQueue>::GetEvent xpcom/threads/ThreadEventQueue.cpp:153
5 xul.dll nsThread::ProcessNextEvent xpcom/threads/nsThread.cpp:1134
6 xul.dll NS_ProcessNextEvent xpcom/threads/nsThreadUtils.cpp:486
7 xul.dll mozilla::ipc::MessagePump::Run ipc/glue/MessagePump.cpp:110
8 xul.dll MessageLoop::RunHandler ipc/chromium/src/base/
9 xul.dll MessageLoop::Run ipc/chromium/src/base/

This looks like a new crash in Nightly. 14 crashes from 9 installations, which isn't super high volume, but seems pretty high volume for an a11y crash. One of the user comments is " fission???", and indeed all of these crash reports have Fission enabled.

Assignee: nobody → jteh
Blocks: a11y-fission
Priority: -- → P2

For OOP iframes, sometimes, AddChildDoc gets called before the embedder sends us the OuterDocAccessible.
Previously, we crashed when this occurred.
Now, we add the child when the OuterDocAccessible proxy gets created later.

Note that I haven't seen this crash myself, but I'm hoping this fix will deal with it.

Pushed by
When adding a remote child document, if the parent proxy doesn't exist yet, defer adding until it does. r=eeejay
Closed: 5 months ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla70

Retroactively moving fixed bugs whose summaries mention "Fission" (or other Fission-related keywords) but are not assigned to a Fission Milestone to an appropriate Fission Milestone.

This will generate a lot of bugmail, so you can filter your bugmail for the following UUID and delete them en masse:


Fission Milestone: --- → M4
You need to log in before you can comment on or make changes to this bug.