1788597 - Crash in [@ mozilla::a11y::DocAccessible::ProcessQueuedCacheUpdates]

Status: RESOLVED FIXED

(Core :: Disability Access APIs, defect)

Description

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

4 crashes from 3 installations of Firefox 106.0a1 20220831093258 on Windows 11. Top of the stack got touched in bug 1726124 and bug 1786086.

Crash report: https://crash-stats.mozilla.org/report/index/8c960943-580b-43a7-9486-9f5d10220901

Reason: EXCEPTION_ACCESS_VIOLATION_READ

Top 10 frames of crashing thread:

0 xul.dll mozilla::a11y::DocAccessible::ProcessQueuedCacheUpdates accessible/generic/DocAccessible.cpp:1445
1 xul.dll mozilla::a11y::NotificationController::WillRefresh accessible/base/NotificationController.cpp:890
2 xul.dll nsRefreshDriver::Tick layout/base/nsRefreshDriver.cpp:2498
3 xul.dll mozilla::RefreshDriverTimer::TickRefreshDrivers layout/base/nsRefreshDriver.cpp:353
4 xul.dll mozilla::RefreshDriverTimer::Tick layout/base/nsRefreshDriver.cpp:369
5 xul.dll mozilla::VsyncRefreshDriverTimer::TickRefreshDriver layout/base/nsRefreshDriver.cpp:810
6 xul.dll mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::NotifyVsyncTimerOnMainThread layout/base/nsRefreshDriver.cpp:594
7 xul.dll mozilla::dom::VsyncMainChild::RecvNotify dom/ipc/VsyncMainChild.cpp:68
8 xul.dll mozilla::dom::PVsyncChild::OnMessageReceived ipc/ipdl/PVsyncChild.cpp:220
9 xul.dll mozilla::ipc::PBackgroundChild::OnMessageReceived ipc/ipdl/PBackgroundChild.cpp:6327

Comment 1

[James Teh [:Jamie]]

I guess one of the table instances is calling QueueCacheUpdate with a null acc? I wouldn't have thought a table part not having a table ancestor was something that happened in the wild, only in my twisted imagination (the aria-owns test case), but I guess it does somehow/somewhere?

Comment 2

[Ryan VanderMeulen [:RyanVM]]

This is the #1 overall Fenix Nightly topcrash at the moment, FWIW.

Comment 3

[Morgan Reschenberg [:morgan]]

Attachment: Bug 1788597: Null check acc before creating cache update r?Jamie,nlapre,eeejay

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/050487abb54a
Null check acc before creating cache update r=nlapre

Comment 5

[Marian-Vasile Laza]

https://hg.mozilla.org/mozilla-central/rev/050487abb54a