Comment 1 Scoobidiver (away) 2012-05-22 04:42:19 PDT

It's a low volume crash that only affects JAWS 11 users at least in 14.0a2 and 15.0a1.

More reports at:
https://crash-stats.mozilla.com/report/list?signature=nsIDocument%3A%3AGetRootElement%28%29

Comment 2 alexander :surkov 2012-06-01 10:26:41 PDT

Created attachment 629235 [details] [diff] [review]
patch

no better ideas

Comment 3 Trevor Saunders (:tbsaunde) 2012-06-01 10:39:05 PDT

Comment on attachment 629235 [details] [diff] [review]
patch

>diff --git a/accessible/src/generic/DocAccessible.cpp b/accessible/src/generic/DocAccessible.cpp
>--- a/accessible/src/generic/DocAccessible.cpp
>+++ b/accessible/src/generic/DocAccessible.cpp
>@@ -631,16 +631,19 @@ DocAccessible::Shutdown()
>   if (!mPresShell) // already shutdown
>     return;
> 
> #ifdef DEBUG
>   if (logging::IsEnabled(logging::eDocDestroy))
>     logging::DocDestroy("document shutdown", mDocument, this);
> #endif
> 
>+  // Mark early since it seems ATs get lucky to call into us during shutdown.
>+  mFlags |= eIsDefunct;
>+
>   if (mNotificationController) {
>     mNotificationController->Shutdown();
>     mNotificationController = nsnull;
>   }
> 
>   RemoveEventListeners();
> 
>   // Mark the document as shutdown before AT is notified about the document

want to update this comment? or perhaps mark it as defunct here, to restore behavior from before making IsDefunct() inline?

Comment 4 alexander :surkov 2012-06-01 10:56:40 PDT

it's reasonable assumption since bug 737724 (inlinging IsDefunct()) is landed on 14 where the crash appeared.

Comment 5 alexander :surkov 2012-06-01 10:57:18 PDT

Created attachment 629249 [details] [diff] [review]
patch2

Comment 6 alexander :surkov 2012-06-01 22:14:13 PDT

https://hg.mozilla.org/integration/mozilla-inbound/rev/26b8f2292405

Comment 7 :Ehsan Akhgari 2012-06-02 12:27:04 PDT

https://hg.mozilla.org/mozilla-central/rev/26b8f2292405