1734541 - Crash in [@ mozilla::a11y::PDocAccessibleChild::SendCache]

Status: RESOLVED FIXED

(Core :: Disability Access APIs, defect)

Description

[Calixte Denizet (:calixte)]

Maybe Fission related. (DOMFissionEnabled=1)

Crash report: https://crash-stats.mozilla.org/report/index/62b31cbf-c110-4f46-94a6-eb3210211006

Reason: EXC_BAD_ACCESS / KERN_INVALID_ADDRESS

Top 10 frames of crashing thread:

0 XUL mozilla::a11y::PDocAccessibleChild::SendCache ipc/ipdl/PDocAccessibleChild.cpp:684
1 XUL nsAccessibilityService::NotifyOfResolutionChange accessible/base/nsAccessibilityService.cpp:410
2 XUL mozilla::PresShell::SetResolutionAndScaleTo layout/base/PresShell.cpp:5422
3 XUL mozilla::ScrollFrameHelper::RestoreState layout/generic/nsGfxScrollFrame.cpp:7333
4 XUL {virtual override thunk} 
5 XUL nsCSSFrameConstructor::InitAndRestoreFrame layout/base/nsCSSFrameConstructor.cpp:4669
6 XUL nsCSSFrameConstructor::BeginBuildingScrollFrame layout/base/nsCSSFrameConstructor.cpp:4239
7 XUL nsCSSFrameConstructor::ContentRangeInserted layout/base/nsCSSFrameConstructor.cpp:6986
8 XUL mozilla::PresShell::Initialize layout/base/PresShell.cpp:1859
9 XUL mozilla::dom::PrototypeDocumentContentSink::DoneWalking dom/prototype/PrototypeDocumentContentSink.cpp:669

There is 1 crash in nightly 95 with buildid 20211006094130. In analyzing the backtrace, the regression may have been introduced by patch [1] to fix bug 1726227.

[1] https://hg.mozilla.org/mozilla-central/rev?node=3cfe5bd5d084

Comment 1

[James Teh [:Jamie]]

I didn't spot this in review :(, but I guess there's no reason nsAccessibilityService::NotifyOfResolutionChange can't be called before DocAccessible::DoInitialUpdate is called. In that case, the IPC document won't exist yet, nor will the initial cache push have occurred. A simple null check should suffice here, for now at least.

Comment 2

[Morgan Reschenberg [:morgan]]

haha this crash report is mine :)
I'll put up a patch for this

Comment 3

[Morgan Reschenberg [:morgan]]

Attachment: Bug 1734541: Verify IPC doc exists before sending resolution update r?Jamie

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/a28e38db75a1
Verify IPC doc exists before sending resolution update r=Jamie

Comment 5

[Marian-Vasile Laza]

https://hg.mozilla.org/mozilla-central/rev/a28e38db75a1