crash in nsAccTreeWalker::NextChildInternal @ nsIFrame::IsGeneratedContentFrame

RESOLVED FIXED in mozilla14

Status

()

Core
Disability Access APIs
--
critical
RESOLVED FIXED
5 years ago
5 years ago

People

(Reporter: Scoobidiver (away), Assigned: surkov)

Tracking

({crash, regression})

14 Branch
mozilla14
All
Windows 7
crash, regression
Points:
---
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(Not tracked)

Details

(crash signature)

Attachments

(1 attachment)

(Reporter)

Description

5 years ago
It first appeared in 14.0a1/20120317120657. The regression window is:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=e5f6caa40409&tochange=da5e8f6a44bd

It's likely a regression from bug 732389.

Signature 	nsIFrame::IsGeneratedContentFrame() More Reports Search
UUID	b1673f21-fbb1-40cc-8820-7d7872120318
Date Processed	2012-03-18 21:04:03
Uptime	8693
Last Crash	1.2 days before submission
Install Age	2.4 hours since version was first installed.
Install Time	2012-03-18 18:38:25
Product	Firefox
Version	14.0a1
Build ID	20120318031036
Release Channel	nightly
OS	Windows NT
OS Version	6.1.7601 Service Pack 1
Build Architecture	x86
Build Architecture Info	AuthenticAMD family 16 model 4 stepping 3
Crash Reason	EXCEPTION_ACCESS_VIOLATION_READ
Crash Address	0xfffffffff0de8027
App Notes 	
AdapterVendorID: 0x10de, AdapterDeviceID: 0x05e6, AdapterSubsysID: 069e196e, AdapterDriverVersion: 8.17.12.9610
D2D? D2D+ DWrite? DWrite+ D3D10 Layers? D3D10 Layers+ 
EMCheckCompatibility	True	
Total Virtual Memory	4294836224
Available Virtual Memory	3010633728
System Memory Use Percentage	69
Available Page File	5300412416
Available Physical Memory	1301540864

Frame 	Module 	Signature [Expand] 	Source
0 	xul.dll 	nsIFrame::IsGeneratedContentFrame 	layout/generic/nsIFrame.h:2511
1 	xul.dll 	nsLayoutUtils::IsGeneratedContentFor 	layout/base/nsLayoutUtils.cpp:509
2 	xul.dll 	nsLayoutUtils::GetBeforeFrame 	layout/base/nsLayoutUtils.cpp:432
3 	xul.dll 	nsGenericElement::GetChildren 	content/base/src/nsGenericElement.cpp:3328
4 	xul.dll 	nsAccTreeWalker::NextChildInternal 	accessible/src/base/nsAccTreeWalker.cpp:104
5 	xul.dll 	nsAccessible::CacheChildren 	accessible/src/base/nsAccessible.cpp:3042
6 	xul.dll 	nsAccessible::EnsureChildren 	accessible/src/base/nsAccessible.cpp:3083
7 	xul.dll 	nsAccessible::UpdateChildren 	accessible/src/base/nsAccessible.h:291
8 	xul.dll 	nsDocAccessible::RecreateAccessible 	accessible/src/base/nsDocAccessible.cpp:1475
9 	xul.dll 	NotificationController::HandleNotification<nsDocAccessible,nsIContent> 	accessible/src/base/NotificationController.h:179
10 	xul.dll 	nsDocAccessible::HandleNotification<nsDocAccessible,nsIContent> 	accessible/src/base/nsDocAccessible.h:268
11 	xul.dll 	nsAccessibilityService::RecreateAccessible 	accessible/src/base/nsAccessibilityService.cpp:681
12 	xul.dll 	nsImageFrame::DisconnectMap 	layout/generic/nsImageFrame.cpp:221
13 	xul.dll 	nsFrameList::DestroyFramesFrom 	layout/generic/nsFrameList.cpp:94
14 	xul.dll 	nsBlockFrame::DestroyFrom 	layout/generic/nsBlockFrame.cpp:315
15 	xul.dll 	nsBlockFrame::DestroyFrom 	layout/generic/nsBlockFrame.cpp:321
16 	xul.dll 	nsFrameList::DestroyFramesFrom 	layout/generic/nsFrameList.cpp:93
...

More reports at:
https://crash-stats.mozilla.com/report/list?signature=nsIFrame%3A%3AIsGeneratedContentFrame%28%29
(Assignee)

Comment 1

5 years ago
Created attachment 608175 [details] [diff] [review]
patch

do RecreateAccessible as pair of sync RemoveContent and async InsertContent.
Assignee: nobody → surkov.alexander
Status: NEW → ASSIGNED
Attachment #608175 - Flags: review?(trev.saunders)
Attachment #608175 - Flags: review?(trev.saunders) → review+
(Assignee)

Comment 2

5 years ago
https://hg.mozilla.org/integration/mozilla-inbound/rev/2c770225ec8f
https://hg.mozilla.org/mozilla-central/rev/2c770225ec8f
Status: ASSIGNED → RESOLVED
Last Resolved: 5 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla14
(Assignee)

Updated

5 years ago
Flags: in-testsuite+
You need to log in before you can comment on or make changes to this bug.