1616797 - Crash in [@ mozilla::a11y::DocAccessible::DispatchScrollingEvent]

Status: RESOLVED FIXED

(Core :: Disability Access APIs, defect, P1)

Description

[Calixte Denizet (:calixte)]

This bug is for crash report bp-a7617002-1b31-4af6-86f4-860e70200220.

Top 10 frames of crashing thread:

0 xul.dll mozilla::a11y::DocAccessible::DispatchScrollingEvent accessible/generic/DocAccessible.cpp:2536
1 xul.dll static mozilla::a11y::DocAccessible::ScrollTimerCallback accessible/generic/DocAccessible.cpp:548
2 xul.dll nsTimerImpl::Fire xpcom/threads/nsTimerImpl.cpp:562
3 xul.dll nsTimerEvent::Run xpcom/threads/TimerThread.cpp:259
4 xul.dll nsThread::ProcessNextEvent xpcom/threads/nsThread.cpp:1220
5 xul.dll NS_ProcessNextEvent xpcom/threads/nsThreadUtils.cpp:481
6 xul.dll mozilla::ipc::MessagePump::Run ipc/glue/MessagePump.cpp:87
7 xul.dll MessageLoop::RunHandler ipc/chromium/src/base/message_loop.cc:308
8 xul.dll MessageLoop::Run ipc/chromium/src/base/message_loop.cc:290
9 xul.dll nsBaseAppShell::Run widget/nsBaseAppShell.cpp:137

There is 1 crash in nightly 75 with buildid 20200219095352. In analyzing the backtrace, the regression may have been introduced by patch [1] to fix bug 1611060.

[1] https://hg.mozilla.org/mozilla-central/rev?node=1e75ce1fef67

Comment 1

[Eitan Isaacson [:eeejay]]

Not 100% sure whats happening here. I guess because this is async the frame could have been destroyed by the time we get here (eg. display: contents). A null check on the frame should resolve this.

Comment 2

[Eitan Isaacson [:eeejay]]

Yup:

<div role="group" id="vp" style="height: 100%; overflow: auto;"><div style="height: 300vh;"></div></div>
<script>
  setTimeout(() => {
    vp.scrollTo(0,10);
    vp.style.display = "contents"
  }, 1000);
</script>

Comment 3

[Eitan Isaacson [:eeejay]]

Attachment: Bug 1616797 - Check that accessible's frame still exists in scroll dispatcher r?Jamie

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/4c518f1d119a
Check that accessible's frame still exists in scroll dispatcher r=Jamie

Comment 5

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

https://hg.mozilla.org/mozilla-central/rev/4c518f1d119a