613466 - crash [@ IDRefsIterator::IDRefsIterator(nsIContent*, nsIAtom*) ]

Status: RESOLVED FIXED

(Core :: Disability Access APIs, defect)

Description

[Scoobidiver (away)]

It is a new crash signature that was introduced by 4.0b8pre/20101118 build.
It is #3 top crasher in this build.

Signature	IDRefsIterator::IDRefsIterator(nsIContent*, nsIAtom*)
UUID	50f2093b-70a1-4132-bef4-d110e2101118
Time 	2010-11-18 22:02:24.4725
Uptime	30389
Last Crash	1085115 seconds (1.8 weeks) before submission
Install Age	30389 seconds (8.4 hours) since version was first installed.
Product	Firefox
Version	4.0b8pre
Build ID	20101118112142
Branch	2.0
OS	Windows NT
OS Version	6.1.7600
CPU	x86
CPU Info	GenuineIntel family 6 model 15 stepping 13
Crash Reason	EXCEPTION_ACCESS_VIOLATION_READ
Crash Address	0xc
App Notes 	AdapterVendorID: 1002, AdapterDeviceID: 95c2

Frame 	Module 	Signature [Expand] 	Source
0 	xul.dll 	IDRefsIterator::IDRefsIterator 	accessible/src/base/nsCoreUtils.cpp:1116
1 	xul.dll 	nsDocAccessible::RemoveDependentIDsFor 	accessible/src/base/nsDocAccessible.cpp:1645
2 	xul.dll 	nsDocAccessible::UnbindFromDocument 	accessible/src/base/nsDocAccessible.cpp:1409
3 	xul.dll 	nsDocAccessible::ShutdownChildrenInSubtree 	accessible/src/base/nsDocAccessible.cpp:1930
4 	xul.dll 	nsDocAccessible::ShutdownChildrenInSubtree 	accessible/src/base/nsDocAccessible.cpp:1927
5 	xul.dll 	nsDocAccessible::ShutdownChildrenInSubtree 	accessible/src/base/nsDocAccessible.cpp:1927
6 	xul.dll 	nsDocAccessible::ProcessPendingEvent 	accessible/src/base/nsDocAccessible.cpp:1818
7 	xul.dll 	nsAccEventQueue::WillRefresh 	accessible/src/base/nsEventShell.cpp:210
8 	xul.dll 	nsRefreshDriver::Notify 	layout/base/nsRefreshDriver.cpp:254
9 	xul.dll 	nsTimerImpl::Fire 	xpcom/threads/nsTimerImpl.cpp:428
10 	xul.dll 	nsTimerEvent::Run 	xpcom/threads/nsTimerImpl.cpp:517
11 	xul.dll 	nsThread::ProcessNextEvent 	xpcom/threads/nsThread.cpp:610
12 	xul.dll 	mozilla::ipc::MessagePump::Run 	ipc/glue/MessagePump.cpp:110
13 	xul.dll 	xul.dll@0xb0332b 	
14 	xul.dll 	MessageLoop::RunHandler 	ipc/chromium/src/base/message_loop.cc:202
15 	mozcrt19.dll 	_VEC_memzero 	
16 	xul.dll 	xul.dll@0x35871d 	
17 	firefox.exe 	firefox.exe@0x1bb7 	
18 	ntdll.dll 	WinSqmSetIfMaxDWORD 	
19 	ntdll.dll 	_RtlUserThreadStart 	
20 	firefox.exe 	firefox.exe@0x186f 	
21 	firefox.exe 	firefox.exe@0x186f 	

The regression range is:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=ad227939db82&tochange=7e42ccaa7269

More reports at:
http://crash-stats.mozilla.com/report/list?product=Firefox&query_search=signature&query_type=exact&query=&range_value=4&range_unit=weeks&hang_type=any&process_type=any&plugin_field=&plugin_query_type=&plugin_query=&do_query=1&admin=&signature=IDRefsIterator%3A%3AIDRefsIterator%28nsIContent*%2C%20nsIAtom*%29

Comment 1

[alexander :surkov (:asurkov)]

Attachment: patch

it sounds like accessible should be shutdown since it doesn't have a content (it can't be application accessible since it doesn't participate in Bind/UnbindTo/FromDocument process). No idea why it can be shutdown. Adding assertion and check.

Comment 2

[David Bolter [:davidb] (NeedInfo me for attention)]

Approved blocking beta 9.

Comment 3

[David Bolter [:davidb] (NeedInfo me for attention)]

Comment on attachment 491812 [details] [diff] [review]
patch

What websites does this happen on?

Alexander, yeah let's take this, and dig deeper in the meantime. Maybe there is something funny with multiple relations with the same ID? (Grab me on IRC)

Comment 4

[David Bolter [:davidb] (NeedInfo me for attention)]

(Hmm multiple relations probably a red herring actually)

Changing to all platforms, found a linux stack:

http://crash-stats.mozilla.com/report/index/b41022e4-2b53-4a89-8050-a1a702101118
"Performed a Google search with a browser session that was open for a long time."

Comment 5

[alexander :surkov (:asurkov)]

(In reply to comment #3)
> Comment on attachment 491812 [details] [diff] [review]
> patch
> 
> What websites does this happen on?

I don't have this info.

> Alexander, yeah let's take this, and dig deeper in the meantime.

Any hint how?

> Maybe there is
> something funny with multiple relations with the same ID?

I don't see how. At least stack is about different things.

Comment 6

[alexander :surkov (:asurkov)]

landed on 2.0 http://hg.mozilla.org/mozilla-central/rev/6c2f603ae217

Comment 7

[LegNeato]

As per today's meeting, beta 9 will be a time-based release. Marking these all betaN+. Please move it back to beta9+ if  you believe it MUST be in the next beta (ie: trunk is in an unshippable state without this)