1579394 - Crash in [@ InvalidArrayIndex_CRASH | nsTArray_Impl<T>::RemoveElementsAt | mozilla::a11y::HyperTextAccessible::RemoveChild]

Status: RESOLVED DUPLICATE of bug 1578282

(Core :: Disability Access APIs, defect)

Description

[Marcia Knous [:marcia]]

This bug is for crash report bp-78507dd1-d659-42d4-906f-e6be50190906.

Spinning this bug out of Bug 1578416 since it is a different crash: https://mzl.la/2lDlffx and the current top crash in 70.0b3.

Top 10 frames of crashing thread:

0 xul.dll InvalidArrayIndex_CRASH xpcom/ds/nsTArray.cpp:27
1 xul.dll nsTArray_Impl<Expr*, nsTArrayInfallibleAllocator>::RemoveElementsAt xpcom/ds/nsTArray.h:2274
2 xul.dll mozilla::a11y::HyperTextAccessible::RemoveChild accessible/generic/HyperTextAccessible.cpp:1782
3 xul.dll bool mozilla::a11y::DocAccessible::MoveChild accessible/generic/DocAccessible.cpp:2319
4 xul.dll mozilla::a11y::DocAccessible::ProcessContentInserted accessible/generic/DocAccessible.cpp:1911
5 xul.dll void mozilla::a11y::NotificationController::WillRefresh accessible/base/NotificationController.cpp:743
6 xul.dll void nsRefreshDriver::Tick layout/base/nsRefreshDriver.cpp:1928
7 xul.dll void mozilla::InactiveRefreshDriverTimer::TickOne layout/base/nsRefreshDriver.cpp:962
8 xul.dll mozilla::InactiveRefreshDriverTimer::TimerTickOne layout/base/nsRefreshDriver.cpp:971
9 xul.dll nsTimerImpl::Fire xpcom/threads/nsTimerImpl.cpp:561

Comment 1

[Marcia Knous [:marcia]]

Almost 100% of the crashes are running Win 7. The Moz Crash reason is the same for almost all, although some reports have ElementAt(aIndex = 18446744073709551615, aLength = 0)

(68.99% in signature vs 35.38% overall) shutdown_progress = null [100.0% vs 31.06% if process_type = content]
(100.0% in signature vs 36.59% overall) moz_crash_reason = ElementAt(aIndex = 4294967295, aLength = 0)
(99.21% in signature vs 41.80% overall) Module "AccessibleHandler.dll" = true
(100.0% in signature vs 43.88% overall) Module "MP3DMOD.DLL" = true
(40.43% in signature vs 97.10% overall) abort_message = null
(97.27% in signature vs 43.54% overall) Module "oleacc.dll" = true
(38.27% in signature vs 86.18% overall) contains_memory_report = null
(100.0% in signature vs 43.46% overall) accessibility = Active [100.0% vs 55.28% if process_type = content]
(100.0% in signature vs 42.14% overall) Module "sxs.dll" = true [100.0% vs 58.50% if platform_pretty_version = Windows 7]
(100.0% in signature vs 42.80% overall) Module "ia2marshal.dll" = true [100.0% vs 58.82% if platform_pretty_version = Windows 7]

Comment 2

[Marcia Knous [:marcia]]

[Tracking Requested - why for this release]: Fairly large volume new crash in 70.0b3, with many more crashes than installs.

Comment 3

[Liz Henry (:lizzard) (relman/hg->git project)]

Jamie, can you help find someone to investigate this top crash in beta 3? Thanks!

Comment 4

[Eitan Isaacson [:eeejay]]

I reproduced this. Seems like the patch from bug 1578282 fixes this. Lets land that and see if its a dup.

Comment 5

[Pascal Chevrel:pascalc]

Setting as blocker for 70 given the volume on beta.

Comment 6

[[:philipp]]

the crashes are indeed gone in 70.0b5.

Comment 7

[Emma Humphries ☕️🎸🧞‍♀️✨ (she/they) [:emceeaich] (Pacific Time) use needinfo]

This bug has been identified as part of a pilot on determining root causes of blocking and dot release drivers.

It needs a root-cause set for it. Please see the list at https://docs.google.com/document/d/1FFEGsmoU8T0N8R9kk-MXWptOPtXXXRRIe4vQo3_HgMw/.

Add the root cause as a whiteboard tag in the form [rca - <cause> ] and remove the rca-needed keyword.

If you have questions, please contact :tmaity.