418142 - Crash [@ nsCOMPtr_base::assign_with_AddRef][@ extent_tree_ad_s_RB_REMOVE] with q, focusing and toggling iframe

Status: RESOLVED DUPLICATE of bug 432467

(Core :: Disability Access APIs, defect)

Description

[Martijn Wargers (dead)]

Attachment: zipped up testcase

See zipped up testcase, to reproduce the crash, unzip the zipped up testcase, then open the file named 'pparent.htm'.

http://crash-stats.mozilla.com/report/index/0a2360a3-ddb4-11dc-839b-001a4bd46e84
0  	nsDocAccessible::FlushPendingEvents()  	 mozilla/accessible/src/base/nsDocAccessible.cpp:1523
1 	nsDocAccessible::FlushEventsCallback(nsITimer*, void*) 	mozilla/accessible/src/base/nsDocAccessible.cpp:1653
2 	nsTimerImpl::Fire() 	mozilla/xpcom/threads/nsTimerImpl.cpp:400
3 	nsTimerEvent::Run() 	mozilla/xpcom/threads/nsTimerImpl.cpp:488
4 	nsThread::ProcessNextEvent(int, int*) 	mozilla/xpcom/threads/nsThread.cpp:510
5 	NS_ProcessNextEvent_P(nsIThread*, int) 	nsThreadUtils.cpp:227
6 	nsBaseAppShell::Run() 	mozilla/widget/src/xpwidgets/nsBaseAppShell.cpp:154
7 	nsAppStartup::Run() 	mozilla/toolkit/components/startup/src/nsAppStartup.cpp:181
8 	PR_GetEnv 	
9 	NS_internal_main(int, char**) 	mozilla/browser/app/nsBrowserApp.cpp:158
10 	wmain 	mozilla/toolkit/xre/nsWindowsWMain.cpp:87
11 	__tmainCRTStartup 	crtexe.c:591
12 	BaseProcessStart

Comment 1

[Martijn Wargers (dead)]

I don't get this crash now that bug 419881 is fixes, but I still crash after a while, with varying stack traces:

http://crash-stats.mozilla.com/report/index/b8ad31ae-e6e5-11dc-ad98-001a4bd46e84
0  	GCGraphBuilder::NoteXPCOMChild(nsISupports*)  	 mozilla/xpcom/base/nsCycleCollector.cpp:1362
1 	MemoryElementTraverser 	mozilla/content/xul/templates/src/nsXULTemplateQueryProcessorRDF.cpp:117

http://crash-stats.mozilla.com/report/index/5b576b3a-e6e5-11dc-9649-001a4bd43ed6
0  	arena_dalloc_small  	 jemalloc.c:3992
1 	arena_dalloc 	jemalloc.c:4180
2 	free 	jemalloc.c:5915
3 	nsDocAccessibleWrap::`scalar deleting destructor'(unsigned int) 	
4 	nsAccessNode::LastRelease() 	mozilla/accessible/src/base/nsAccessNode.cpp:145
5 	nsAccessNode::Release() 	mozilla/accessible/src/base/nsAccessNode.cpp:119
6 	nsNodeUtils::AttributeChanged(nsIContent*, int, nsIAtom*, int, unsigned int) 	mozilla/content/base/src/nsNodeUtils.cpp:109
7 	nsGenericElement::SetAttrAndNotify(int, nsIAtom*, nsIAtom*, nsAString_internal const&, nsAttrValue&, int, int, int) 	mozilla/content/base/src/nsGenericElement.cpp:3766
8 	nsGenericElement::SetAttr(int, nsIAtom*, nsIAtom*, nsAString_internal const&, int) 	mozilla/content/base/src/nsGenericElement.cpp:3697
9 	nsXULElement::GetAttr(int, nsIAtom*, nsAString_internal&) 	mozilla/content/xul/content/src/nsXULElement.cpp:1152
10 	xul.dll@0x7e733b 	
11 	nsGenericElement::SetAttrAndNotify(int, nsIAtom*, nsIAtom*, nsAString_internal const&, nsAttrValue&, int, int, int) 	mozilla/content/base/src/nsGenericElement.cpp:3755
12 	nsGenericElement::SetAttr(int, nsIAtom*, nsIAtom*, nsAString_internal const&, int) 	mozilla/content/base/src/nsGenericElement.cpp:3697

http://crash-stats.mozilla.com/report/index/17b969dc-e6e5-11dc-bb1b-001a4bd46e84
0  	arena_dalloc_small  	 jemalloc.c:3992
1 	arena_dalloc 	jemalloc.c:4180
2 	free 	jemalloc.c:5915
3 	nsDocAccessibleWrap::`scalar deleting destructor'(unsigned int) 	
4 	nsAccessNode::LastRelease() 	mozilla/accessible/src/base/nsAccessNode.cpp:145
5 	nsAccessNode::Release() 	mozilla/accessible/src/base/nsAccessNode.cpp:119
6 	nsNodeUtils::AttributeChanged(nsIContent*, int, nsIAtom*, int, unsigned int) 	mozilla/content/base/src/nsNodeUtils.cpp:109
7 	nsGenericElement::SetAttrAndNotify(int, nsIAtom*, nsIAtom*, nsAString_internal const&, nsAttrValue&, int, int, int) 	mozilla/content/base/src/nsGenericElement.cpp:3766
8 	nsGenericElement::SetAttr(int, nsIAtom*, nsIAtom*, nsAString_internal const&, int) 	mozilla/content/base/src/nsGenericElement.cpp:3697
9 	nsXULElement::GetAttr(int, nsIAtom*, nsAString_internal&) 	mozilla/content/xul/content/src/nsXULElement.cpp:1152
10 	xul.dll@0x7e733b 	
11 	nsGenericElement::SetAttrAndNotify(int, nsIAtom*, nsIAtom*, nsAString_internal const&, nsAttrValue&, int, int, int) 	mozilla/content/base/src/nsGenericElement.cpp:3755
12 	nsGenericElement::SetAttr(int, nsIAtom*, nsIAtom*, nsAString_internal const&, int) 	mozilla/content/base/src/nsGenericElement.cpp:3697

http://crash-stats.mozilla.com/report/index/0b7c5302-e6e5-11dc-85bf-001a4bd43ed6
0  	extent_tree_ad_s_RB_REMOVE  	 jemalloc.c:1934
1 	arena_run_dalloc 	jemalloc.c:3213
2 	arena_dalloc 	jemalloc.c:4185
3 	free 	jemalloc.c:5915
4 	ChildWindow::`scalar deleting destructor'(unsigned int) 	
5 	nsWindow::Release() 	mozilla/widget/src/windows/nsWindow.cpp:787
6 	nsView::~nsView() 	mozilla/view/src/nsView.cpp:274
7 	nsScrollPortView::~nsScrollPortView() 	mozilla/view/src/nsScrollPortView.cpp:107
8 	nsScrollPortView::`vector deleting destructor'(unsigned int) 	
9 	nsIView::Destroy() 	mozilla/view/src/nsView.cpp:314
10 	nsView::~nsView() 	mozilla/view/src/nsView.cpp:224
11 	nsView::`vector deleting destructor'(unsigned int) 	
12 	nsFrame::Destroy() 	mozilla/layout/generic/nsFrame.cpp:505
13 	nsContainerFrame::Destroy() 	mozilla/layout/generic/nsContainerFrame.cpp:257
14 	nsFrameManager::Destroy() 	mozilla/layout/base/nsFrameManager.cpp:283
15 	PresShell::Destroy() 	mozilla/layout/base/nsPresShell.cpp:1677

So I guess this should be moved into a different component? Which one?

Comment 2

[David Weitz]

Believe I'm getting the same thing, but not sure: http://crash-stats.mozilla.com/report/index/a89ec11e-fec7-11dc-bc77-001a4bd43ef6

Comment 3

[Martijn Wargers (dead)]

I don't know, might be the same issue.
Fwiw, this is still crashing, using:
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9pre) Gecko/2008033005 Minefield/3.0pre

http://crash-stats.mozilla.com/report/index/12ffec1e-ff0a-11dc-896d-001a4bd43ef6
0  	nsIFrame::GetClosestView(nsPoint*)  	 mozilla/layout/generic/nsFrame.cpp:5232
1 	nsIFrame::AreAncestorViewsVisible() 	mozilla/layout/generic/nsFrame.cpp:3555
2 	nsDocShell::GetVisibility(int*) 	mozilla/docshell/base/nsDocShell.cpp:3910
3 	nsGenericElement::ShouldFocus(nsIContent*) 	mozilla/content/base/src/nsGenericElement.cpp:2571
4 	nsHTMLAnchorElement::Focus() 	mozilla/content/html/content/src/nsGenericHTMLElement.cpp:3090
5 	nsGenericHTMLElementTearoff::Focus() 	mozilla/content/html/content/src/nsGenericHTMLElement.cpp:196
6 	nsAccessible::TakeFocus() 	mozilla/accessible/src/base/nsAccessible.cpp:1444
7 	NS_InvokeByIndex_P 	mozilla/xpcom/reflect/xptcall/src/md/win32/xptcinvoke.cpp:101
8 	XPCWrappedNative::CallMethod(XPCCallContext&, XPCWrappedNative::CallMode) 	mozilla/js/src/xpconnect/src/xpcwrappednative.cpp:2369

Comment 4

[Damon Sicore (:damons)]

-'ing this as we wouldn't hold a release for this.  However, let's get more information.  Marking as wanted1.9.0.x+

Comment 5

[Martijn Wargers (dead)]

Attachment: testcase2, also using enhanced privileges

This is basically the same as the zipped up testcase, but it's even simpler.

I get various stacktraces with this:
http://crash-stats.mozilla.com/report/index/bac52a54-0c11-11dd-980f-001cc4e2bf68
http://crash-stats.mozilla.com/report/index/88c53e35-0c11-11dd-ac06-001cc45a2ce4
http://crash-stats.mozilla.com/report/index/56d3c359-0c10-11dd-aab7-001321b13766
http://crash-stats.mozilla.com/report/index/24d47df0-0c10-11dd-b4d5-0013211cbf8a
http://crash-stats.mozilla.com/report/index/529bf2b5-0c0f-11dd-80a8-001cc4e2bf68

Comment 6

[Martijn Wargers (dead)]

Latest crashes:
http://crash-stats.mozilla.com/report/index/937b1aeb-1816-11dd-b380-001cc45a2c28?p=1
0  	xul.dll  	nsCOMPtr_base::assign_with_AddRef  	 nsCOMPtr.cpp:88
1 	xul.dll 	nsNodeUtils::ContentAppended 	mozilla/content/base/src/nsNodeUtils.cpp:119
2 	xul.dll 	nsContentSink::NotifyAppend 	mozilla/content/base/src/nsContentSink.cpp:1086
3 	xul.dll 	SinkContext::FlushTags 	mozilla/content/html/document/src/nsHTMLContentSink.cpp:1398
4 	xul.dll 	HTMLContentSink::FlushPendingNotifications 	mozilla/content/html/document/src/nsHTMLContentSink.cpp:3197
5 	xul.dll 	xul.dll@0x2c0459 	
6 	xul.dll 	nsHTMLDocument::GetElementById 	mozilla/content/html/document/src/nsHTMLDocument.cpp:2600
7 	xul.dll 	NS_InvokeByIndex_P 	mozilla/xpcom/reflect/xptcall/src/md/win32/xptcinvoke.cpp:101
8 	xul.dll 	xptiInterfaceEntry::GetMethodInfo 	mozilla/xpcom/reflect/xptinfo/src/xptiInterfaceInfo.cpp:317
9 	xul.dll 	XPCWrappedNative::CallMethod 	mozilla/js/src/xpconnect/src/xpcwrappednative.cpp:2369
10 	xul.dll 	XPC_WN_CallMethod 	mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp:1473
11 	js3250.dll 	js_Invoke 	mozilla/js/src/jsinterp.c:1296
12 	js3250.dll 	js_Interpret 	mozilla/js/src/jsinterp.c:4851
13 	js3250.dll 	js_Execute 	mozilla/js/src/jsinterp.c:1535
14 	js3250.dll 	JS_EvaluateUCScriptForPrincipals 	mozilla/js/src/jsapi.c:4998
15 	xul.dll 	nsJSContext::EvaluateString 	mozilla/dom/src/base/nsJSEnvironment.cpp:1530
16 	xul.dll 	nsScriptLoader::EvaluateScript 	mozilla/content/base/src/nsScriptLoader.cpp:582
17 	xul.dll 	nsScriptLoader::ProcessRequest 	mozilla/content/base/src/nsScriptLoader.cpp:496
18 	xul.dll 	nsCOMPtr_base::assign_with_AddRef 	nsCOMPtr.cpp:89
19 	xul.dll 	nsScriptLoader::ProcessScriptElement 	mozilla/content/base/src/nsScriptLoader.cpp:453
20 	xul.dll 	nsScriptElement::MaybeProcessScript 	mozilla/content/base/src/nsScriptElement.cpp:188

Show/hide other threads

http://crash-stats.mozilla.com/report/index/635f4bb5-1817-11dd-9f9a-001321b13766
0  	mozcrt19.dll  	extent_tree_ad_s_RB_REMOVE  	 jemalloc.c:1975
1 	mozcrt19.dll 	arena_run_dalloc 	jemalloc.c:3215
2 	mozcrt19.dll 	arena_dalloc 	jemalloc.c:4195
3 	mozcrt19.dll 	free 	jemalloc.c:6004
4 	xul.dll 	nsScannerBufferList::DiscardUnreferencedPrefix 	mozilla/parser/htmlparser/src/nsScannerString.cpp:136
5 	xul.dll 	nsScannerSubstring::release_ownership_of_buffer_list 	nsScannerString.h:254
6 	xul.dll 	nsScannerSubstring::~nsScannerSubstring 	mozilla/parser/htmlparser/src/nsScannerString.cpp:182
7 	xul.dll 	CTextToken::~CTextToken 	
8 	xul.dll 	CTextToken::`scalar deleting destructor' 	
9 	xul.dll 	CToken::Destroy 	nsToken.h:147
10 	xul.dll 	CToken::Release 	nsToken.h:169
11 	xul.dll 	CNavDTD::HandleToken 	mozilla/parser/htmlparser/src/CNavDTD.cpp:793
12 	xul.dll 	xul.dll@0x6ea717 	

I'm hitting this almost every time in my testing with accessibility enabled.