Last Comment Bug 736944 - crash in nsAccTreeWalker::NextChildInternal @ nsIFrame::IsGeneratedContentFrame
: crash in nsAccTreeWalker::NextChildInternal @ nsIFrame::IsGeneratedContentFrame
: crash, regression
Product: Core
Classification: Components
Component: Disability Access APIs (show other bugs)
: 14 Branch
: All Windows 7
-- critical (vote)
: mozilla14
Assigned To: alexander :surkov
: alexander :surkov
Depends on:
Blocks: 732389
  Show dependency treegraph
Reported: 2012-03-19 00:09 PDT by Scoobidiver (away)
Modified: 2012-03-23 19:32 PDT (History)
2 users (show)
surkov.alexander: in‑testsuite+
See Also:
Crash Signature:
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---

patch (7.82 KB, patch)
2012-03-21 18:23 PDT, alexander :surkov
tbsaunde+mozbugs: review+
Details | Diff | Splinter Review

Description User image Scoobidiver (away) 2012-03-19 00:09:11 PDT
It first appeared in 14.0a1/20120317120657. The regression window is:

It's likely a regression from bug 732389.

Signature 	nsIFrame::IsGeneratedContentFrame() More Reports Search
UUID	b1673f21-fbb1-40cc-8820-7d7872120318
Date Processed	2012-03-18 21:04:03
Uptime	8693
Last Crash	1.2 days before submission
Install Age	2.4 hours since version was first installed.
Install Time	2012-03-18 18:38:25
Product	Firefox
Version	14.0a1
Build ID	20120318031036
Release Channel	nightly
OS	Windows NT
OS Version	6.1.7601 Service Pack 1
Build Architecture	x86
Build Architecture Info	AuthenticAMD family 16 model 4 stepping 3
Crash Address	0xfffffffff0de8027
App Notes 	
AdapterVendorID: 0x10de, AdapterDeviceID: 0x05e6, AdapterSubsysID: 069e196e, AdapterDriverVersion:
D2D? D2D+ DWrite? DWrite+ D3D10 Layers? D3D10 Layers+ 
EMCheckCompatibility	True	
Total Virtual Memory	4294836224
Available Virtual Memory	3010633728
System Memory Use Percentage	69
Available Page File	5300412416
Available Physical Memory	1301540864

Frame 	Module 	Signature [Expand] 	Source
0 	xul.dll 	nsIFrame::IsGeneratedContentFrame 	layout/generic/nsIFrame.h:2511
1 	xul.dll 	nsLayoutUtils::IsGeneratedContentFor 	layout/base/nsLayoutUtils.cpp:509
2 	xul.dll 	nsLayoutUtils::GetBeforeFrame 	layout/base/nsLayoutUtils.cpp:432
3 	xul.dll 	nsGenericElement::GetChildren 	content/base/src/nsGenericElement.cpp:3328
4 	xul.dll 	nsAccTreeWalker::NextChildInternal 	accessible/src/base/nsAccTreeWalker.cpp:104
5 	xul.dll 	nsAccessible::CacheChildren 	accessible/src/base/nsAccessible.cpp:3042
6 	xul.dll 	nsAccessible::EnsureChildren 	accessible/src/base/nsAccessible.cpp:3083
7 	xul.dll 	nsAccessible::UpdateChildren 	accessible/src/base/nsAccessible.h:291
8 	xul.dll 	nsDocAccessible::RecreateAccessible 	accessible/src/base/nsDocAccessible.cpp:1475
9 	xul.dll 	NotificationController::HandleNotification<nsDocAccessible,nsIContent> 	accessible/src/base/NotificationController.h:179
10 	xul.dll 	nsDocAccessible::HandleNotification<nsDocAccessible,nsIContent> 	accessible/src/base/nsDocAccessible.h:268
11 	xul.dll 	nsAccessibilityService::RecreateAccessible 	accessible/src/base/nsAccessibilityService.cpp:681
12 	xul.dll 	nsImageFrame::DisconnectMap 	layout/generic/nsImageFrame.cpp:221
13 	xul.dll 	nsFrameList::DestroyFramesFrom 	layout/generic/nsFrameList.cpp:94
14 	xul.dll 	nsBlockFrame::DestroyFrom 	layout/generic/nsBlockFrame.cpp:315
15 	xul.dll 	nsBlockFrame::DestroyFrom 	layout/generic/nsBlockFrame.cpp:321
16 	xul.dll 	nsFrameList::DestroyFramesFrom 	layout/generic/nsFrameList.cpp:93

More reports at:
Comment 1 User image alexander :surkov 2012-03-21 18:23:01 PDT
Created attachment 608175 [details] [diff] [review]

do RecreateAccessible as pair of sync RemoveContent and async InsertContent.
Comment 3 User image Marco Bonardo [::mak] 2012-03-23 05:59:09 PDT

Note You need to log in before you can comment on or make changes to this bug.