736944 - crash in nsAccTreeWalker::NextChildInternal @ nsIFrame::IsGeneratedContentFrame

Status: RESOLVED FIXED

(Core :: Disability Access APIs, defect)

Description

[Scoobidiver (away)]

It first appeared in 14.0a1/20120317120657. The regression window is:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=e5f6caa40409&tochange=da5e8f6a44bd

It's likely a regression from bug 732389.

Signature 	nsIFrame::IsGeneratedContentFrame() More Reports Search
UUID	b1673f21-fbb1-40cc-8820-7d7872120318
Date Processed	2012-03-18 21:04:03
Uptime	8693
Last Crash	1.2 days before submission
Install Age	2.4 hours since version was first installed.
Install Time	2012-03-18 18:38:25
Product	Firefox
Version	14.0a1
Build ID	20120318031036
Release Channel	nightly
OS	Windows NT
OS Version	6.1.7601 Service Pack 1
Build Architecture	x86
Build Architecture Info	AuthenticAMD family 16 model 4 stepping 3
Crash Reason	EXCEPTION_ACCESS_VIOLATION_READ
Crash Address	0xfffffffff0de8027
App Notes 	
AdapterVendorID: 0x10de, AdapterDeviceID: 0x05e6, AdapterSubsysID: 069e196e, AdapterDriverVersion: 8.17.12.9610
D2D? D2D+ DWrite? DWrite+ D3D10 Layers? D3D10 Layers+ 
EMCheckCompatibility	True	
Total Virtual Memory	4294836224
Available Virtual Memory	3010633728
System Memory Use Percentage	69
Available Page File	5300412416
Available Physical Memory	1301540864

Frame 	Module 	Signature [Expand] 	Source
0 	xul.dll 	nsIFrame::IsGeneratedContentFrame 	layout/generic/nsIFrame.h:2511
1 	xul.dll 	nsLayoutUtils::IsGeneratedContentFor 	layout/base/nsLayoutUtils.cpp:509
2 	xul.dll 	nsLayoutUtils::GetBeforeFrame 	layout/base/nsLayoutUtils.cpp:432
3 	xul.dll 	nsGenericElement::GetChildren 	content/base/src/nsGenericElement.cpp:3328
4 	xul.dll 	nsAccTreeWalker::NextChildInternal 	accessible/src/base/nsAccTreeWalker.cpp:104
5 	xul.dll 	nsAccessible::CacheChildren 	accessible/src/base/nsAccessible.cpp:3042
6 	xul.dll 	nsAccessible::EnsureChildren 	accessible/src/base/nsAccessible.cpp:3083
7 	xul.dll 	nsAccessible::UpdateChildren 	accessible/src/base/nsAccessible.h:291
8 	xul.dll 	nsDocAccessible::RecreateAccessible 	accessible/src/base/nsDocAccessible.cpp:1475
9 	xul.dll 	NotificationController::HandleNotification<nsDocAccessible,nsIContent> 	accessible/src/base/NotificationController.h:179
10 	xul.dll 	nsDocAccessible::HandleNotification<nsDocAccessible,nsIContent> 	accessible/src/base/nsDocAccessible.h:268
11 	xul.dll 	nsAccessibilityService::RecreateAccessible 	accessible/src/base/nsAccessibilityService.cpp:681
12 	xul.dll 	nsImageFrame::DisconnectMap 	layout/generic/nsImageFrame.cpp:221
13 	xul.dll 	nsFrameList::DestroyFramesFrom 	layout/generic/nsFrameList.cpp:94
14 	xul.dll 	nsBlockFrame::DestroyFrom 	layout/generic/nsBlockFrame.cpp:315
15 	xul.dll 	nsBlockFrame::DestroyFrom 	layout/generic/nsBlockFrame.cpp:321
16 	xul.dll 	nsFrameList::DestroyFramesFrom 	layout/generic/nsFrameList.cpp:93
...

More reports at:
https://crash-stats.mozilla.com/report/list?signature=nsIFrame%3A%3AIsGeneratedContentFrame%28%29

Comment 1

[alexander :surkov (:asurkov)]

Attachment: patch

do RecreateAccessible as pair of sync RemoveContent and async InsertContent.

Comment 2

[alexander :surkov (:asurkov)]

https://hg.mozilla.org/integration/mozilla-inbound/rev/2c770225ec8f

Comment 3

[Marco Bonardo [:mak]]

https://hg.mozilla.org/mozilla-central/rev/2c770225ec8f