520825 - Crash when trying to install extension updates

Status: VERIFIED DUPLICATE of bug 525579

(Core :: Disability Access APIs, defect)

Description

[Chris AtLee [:catlee]]

On Linux 64-bit, when I start up namoroka and get prompted to update my extensions, clicking the "Install Updates" button causes the following crash below.  If I disable accessibility in Gnome, I don't see the crash.

#0  nsIFrame::GetContent (this=0x7ffffffff0dea7ff)
    at /home/catlee/mozilla/mozilla-1.9.2/layout/base/../generic/nsIFrame.h:615
#1  0x00007ffff712148b in nsAccessibilityService::GetAccessible (
    this=0x7fffde102c00, aNode=0x7fffe43decc8, aPresShell=0x7fffe4340800, 
    aWeakShell=0x7fffe4361f80, aFrameHint=0x7fffffffb860, 
    aIsHidden=0x7fffffffb86c, aAccessible=0x7fffffffb838)
    at /home/catlee/mozilla/mozilla-1.9.2/accessible/src/base/nsAccessibilityService.cpp:1422
#2  0x00007ffff712dbb7 in nsAccessibleTreeWalker::GetAccessible (
    this=0x7fffffffb830)
    at /home/catlee/mozilla/mozilla-1.9.2/accessible/src/base/nsAccessibleTreeWalker.cpp:290
#3  0x00007ffff712dd68 in nsAccessibleTreeWalker::GetNextSibling (
    this=0x7fffffffb830)
    at /home/catlee/mozilla/mozilla-1.9.2/accessible/src/base/nsAccessibleTreeWalker.cpp:199
#4  0x00007ffff712c8ca in nsAccessible::CacheChildren (this=0x7fffe42d3ac0)
    at /home/catlee/mozilla/mozilla-1.9.2/accessible/src/base/nsAccessible.cpp:765
#5  0x00007ffff714a659 in nsHyperTextAccessible::CacheChildren (
    this=0x7fffe42d3ac0)
    at /home/catlee/mozilla/mozilla-1.9.2/accessible/src/html/nsHyperTextAccessible.cpp:217
#6  0x00007ffff7125846 in nsAccessible::GetChildCount (
    this=0x7ffffffff0dea7ff, aAccChildCount=0x0)
    at /home/catlee/mozilla/mozilla-1.9.2/accessible/src/base/nsAccessible.cpp:781
#7  0x00007ffff7125b93 in nsAccessible::GetFirstChild (this=0x7fffe42d3ac0, 
    aFirstChild=0x7fffffffbaa0)
    at /home/catlee/mozilla/mozilla-1.9.2/accessible/src/base/nsAccessible.cpp:655
#8  0x00007ffff714bb79 in getIndexInParentCB (aAtkObj=<value optimized out>)
    at /home/catlee/mozilla/mozilla-1.9.2/accessible/src/atk/nsAccessibleWrap.cpp:952
#9  0x00007ffff714bd13 in nsAccessibleWrap::FireAtkShowHideEvent (
    this=<value optimized out>, aEvent=0x0, aObject=0x0, aIsAdded=-466797880)
    at /home/catlee/mozilla/mozilla-1.9.2/accessible/src/atk/nsAccessibleWrap.cpp:1472
#10 0x00007ffff714c105 in nsAccessibleWrap::FirePlatformEvent (
    this=0x7fffe42d3ac0, aEvent=0x7fffdd593240)
    at /home/catlee/mozilla/mozilla-1.9.2/accessible/src/atk/nsAccessibleWrap.cpp:1317
#11 0x00007ffff7115a51 in nsDocAccessible::FlushPendingEvents (
    this=0x7fffe42d3ac0)
    at /home/catlee/mozilla/mozilla-1.9.2/accessible/src/base/nsDocAccessible.cpp:1793
#12 0x00007ffff71cd79a in nsTimerImpl::Fire (this=0x7fffdebed740)
    at /home/catlee/mozilla/mozilla-1.9.2/xpcom/threads/nsTimerImpl.cpp:427
#13 0x00007ffff71cd821 in nsTimerEvent::Run (this=0x7fffe12a5ba0)
    at /home/catlee/mozilla/mozilla-1.9.2/xpcom/threads/nsTimerImpl.cpp:519
#14 0x00007ffff71ca6e3 in nsThread::ProcessNextEvent (this=0x7fffed069080, 
    mayWait=1, result=0x7fffffffbe6c)
    at /home/catlee/mozilla/mozilla-1.9.2/xpcom/threads/nsThread.cpp:527
#15 0x00007ffff7199c07 in NS_ProcessNextEvent_P (thread=0x7ffffffff0dea7ff, 
    mayWait=1) at nsThreadUtils.cpp:230
---Type <return> to continue, or q <return> to quit---
#16 0x00007ffff6f9ae59 in nsXULWindow::ShowModal (this=0x7fffed19b990)
    at /home/catlee/mozilla/mozilla-1.9.2/xpfe/appshell/src/nsXULWindow.cpp:414
#17 0x00007ffff6f7022e in nsWindowWatcher::OpenWindowJSInternal (
    this=0x7fffed166100, aParent=0x0, aUrl=<value optimized out>, 
    aName=<value optimized out>, 
    aFeatures=0x7ffff6f37628 "H\201\307\20\377\377\377\353\1\220AWAVAUI\211\325ATUH\211\375S1\333H\201\354\350\1", aDialog=1, argv=0x7fffe41b5420, 
    aCalledFromJS=0, _retval=0x7fffffffc998)
    at /home/catlee/mozilla/mozilla-1.9.2/embedding/components/windowwatcher/src/nsWindowWatcher.cpp:991
#18 0x00007ffff6f70c4a in nsWindowWatcher::OpenWindow (this=0x7fffed166100, 
    aParent=0x0, 
    aUrl=0x7fffe40f71c0 "chrome://mozapps/content/extensions/extensions.xul", 
    aName=0x0, 
    aFeatures=0x7fffe40f7200 "chrome,centerscreen,extra-chrome,dialog,resizable,modal", aArguments=0x1, _retval=0x7fffffffc998)
    at /home/catlee/mozilla/mozilla-1.9.2/embedding/components/windowwatcher/src/nsWindowWatcher.cpp:423
#19 0x00007ffff71d748a in NS_InvokeByIndex_P (that=0x7fffed166100, 
    methodIndex=3, paramCount=6, params=0x7fffffffc920)
    at /home/catlee/mozilla/mozilla-1.9.2/xpcom/reflect/xptcall/src/md/unix/xptcinvoke_x86_64_unix.cpp:208
#20 0x00007ffff68989f3 in XPCWrappedNative::CallMethod (ccx=..., 
    mode=<value optimized out>)
    at /home/catlee/mozilla/mozilla-1.9.2/js/src/xpconnect/src/xpcwrappednative.cpp:2710
#21 0x00007ffff68a140f in XPC_WN_CallMethod (cx=0x7fffea187800, 
    obj=0x7fffe40ffc80, argc=5, argv=0x7fffea10cdf0, vp=0x7fffffffcda8)
    at /home/catlee/mozilla/mozilla-1.9.2/js/src/xpconnect/src/xpcwrappednativejsops.cpp:1740
#22 0x00007ffff614c7cb in js_Invoke (cx=0x7fffea187800, argc=5, 
    vp=0x7fffea10cde0, flags=<value optimized out>)
    at /home/catlee/mozilla/mozilla-1.9.2/js/src/jsinterp.cpp:1374
#23 0x00007ffff613e018 in js_Interpret (cx=0x7fffea187800)
    at /home/catlee/mozilla/mozilla-1.9.2/js/src/jsops.cpp:2240
#24 0x00007ffff614cb88 in js_Invoke (cx=0x7fffea187800, argc=0, 
    vp=0x7fffed04aac8, flags=<value optimized out>)
    at /home/catlee/mozilla/mozilla-1.9.2/js/src/jsinterp.cpp:1382
#25 0x00007ffff689538b in nsXPCWrappedJSClass::CallMethod (
    this=0x7fffe4ebf6c0, wrapper=<value optimized out>, methodIndex=3, 
    info=0x7fffe4450c10, nativeParams=0x7fffffffd7d0)
    at /home/catlee/mozilla/mozilla-1.9.2/js/src/xpconnect/src/xpcwrappedjsclass.cpp:1671
#26 0x00007ffff71d804a in PrepareAndDispatch (self=0x7fffe4425440, 
    methodIndex=<value optimized out>, args=0x7fffffffd930, 
    gpregs=0x7fffffffd8b0, fpregs=0x7fffffffd8e0)
    at /home/catlee/mozilla/mozilla-1.9.2/xpcom/reflect/xptcall/src/md/unix/xptcstubs_x86_64_linux.cpp:153
#27 0x00007ffff71d74ff in SharedStub () from ./objdir/dist/bin/libxul.so
#28 0x00007ffff68696c3 in XRE_main (argc=<value optimized out>, 
    argv=<value optimized out>, aAppData=<value optimized out>)
    at /home/catlee/mozilla/mozilla-1.9.2/toolkit/xre/nsAppRunner.cpp:3396
#29 0x0000000000401d81 in main (argc=1, argv=0x7fffffffe028)
    at /home/catlee/mozilla/mozilla-1.9.2/browser/app/nsBrowserApp.cpp:156

Comment 1

[alexander :surkov (:asurkov)]

Something wrong in nsAccessibleTreeWalker::GetAccessible. It sounds mState.frame is bad object that was destroyed and it is passed to nsAccessibilityService::GetAccessible() . Therefore we fail to call frame->GetContent(), see http://mxr.mozilla.org/mozilla1.9.2/source/accessible/src/base/nsAccessibilityService.cpp#1422

This is another side of the bug 434445. We fire hide event (http://mxr.mozilla.org/mozilla1.9.2/source/accessible/src/atk/nsAccessibleWrap.cpp#1317) which is processed by AT, AT request indexOfParent which makes us to create and cache accessible children for destroyed element.

Comment 2

[David Bolter [:davidb] (NeedInfo me for attention)]

Alexander can you recreate it?

Comment 3

[David Bolter [:davidb] (NeedInfo me for attention)]

Just noticed the poison frame signature. You were first but the bug with momentum is topcrash bug 525579 (some reports have comments about add-on updates).