1773104 - Crash in [@ mozilla::a11y::DocAccessibleChild::SerializedChildDocConstructor::Dispatch]

Status: RESOLVED FIXED

(Core :: Disability Access APIs, defect)

Description

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

15 crashes from 6+ Windows installations

Crash report: https://crash-stats.mozilla.org/report/index/07df126c-c4b5-4b02-87c4-3614d0220607

Reason: EXCEPTION_ACCESS_VIOLATION_READ

Top 10 frames of crashing thread:

0 xul.dll mozilla::a11y::DocAccessibleChild::SerializedChildDocConstructor::Dispatch accessible/ipc/win/DocAccessibleChild.h:329
1 xul.dll mozilla::a11y::DocAccessibleChild::RecvParentCOMProxy accessible/ipc/win/DocAccessibleChild.cpp:60
2 xul.dll mozilla::a11y::PDocAccessibleChild::OnMessageReceived ipc/ipdl/PDocAccessibleChild.cpp:801
3 xul.dll mozilla::dom::PContentChild::OnMessageReceived ipc/ipdl/PContentChild.cpp:8523
4 xul.dll mozilla::ipc::MessageChannel::MessageTask::Run ipc/glue/MessageChannel.cpp:1604
5 xul.dll mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal xpcom/threads/TaskController.cpp:788
6 xul.dll mozilla::TaskController::ProcessPendingMTTask xpcom/threads/TaskController.cpp:398
7 xul.dll nsThread::ProcessNextEvent xpcom/threads/nsThread.cpp:1180
8 xul.dll mozilla::ipc::MessagePump::Run ipc/glue/MessagePump.cpp:107
9 xul.dll MessageLoop::RunHandler ipc/chromium/src/base/message_loop.cc:373

Comment 1

[James Teh [:Jamie]]

I guess the BrowsingContext died, which I think suggests the document (and probably the DocAccessible) died. We probably shouldn't replay deferred events for dead documents, but fixing that is probably going to be tricky and we'll be getting rid of this deferred events stuff once we ship CTW anyway. Instead, I guess we'll hold a reference to the BrowsingContext.

Comment 2

[James Teh [:Jamie]]

Attachment: Bug 1773104: Hold a reference to the BrowsingContext when deferring the sending of a PDocAccessible constructor.

Comment 3

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/af3395df3738
Hold a reference to the BrowsingContext when deferring the sending of a PDocAccessible constructor. r=eeejay

Comment 4

[Narcis Beleuzu [:NarcisB]]

https://hg.mozilla.org/mozilla-central/rev/af3395df3738