crash in nsIDocument::GetRootElement mainly with JAWS 11

RESOLVED FIXED in mozilla15

Status

()

Core
Disability Access APIs
--
critical
RESOLVED FIXED
5 years ago
5 years ago

People

(Reporter: MarcoZ, Assigned: surkov)

Tracking

({crash})

14 Branch
mozilla15
x86
Windows NT
crash
Points:
---

Firefox Tracking Flags

(Not tracked)

Details

(crash signature)

Attachments

(1 attachment, 1 obsolete attachment)

934 bytes, patch
tbsaunde
: review+
Details | Diff | Splinter Review
(Reporter)

Description

5 years ago
This bug was filed from the Socorro interface and is 
report bp-ed0a3edc-42e6-457a-b7f8-523c82120519 .
============================================================= 

Reported to me by a community member.

Comment 1

5 years ago
It's a low volume crash that only affects JAWS 11 users at least in 14.0a2 and 15.0a1.

More reports at:
https://crash-stats.mozilla.com/report/list?signature=nsIDocument%3A%3AGetRootElement%28%29
Summary: crash in nsIDocument::GetRootElement → crash in nsIDocument::GetRootElement mainly with JAWS 11
(Assignee)

Comment 2

5 years ago
Created attachment 629235 [details] [diff] [review]
patch

no better ideas
Assignee: nobody → surkov.alexander
Status: NEW → ASSIGNED
Attachment #629235 - Flags: review?(trev.saunders)
Comment on attachment 629235 [details] [diff] [review]
patch

>diff --git a/accessible/src/generic/DocAccessible.cpp b/accessible/src/generic/DocAccessible.cpp
>--- a/accessible/src/generic/DocAccessible.cpp
>+++ b/accessible/src/generic/DocAccessible.cpp
>@@ -631,16 +631,19 @@ DocAccessible::Shutdown()
>   if (!mPresShell) // already shutdown
>     return;
> 
> #ifdef DEBUG
>   if (logging::IsEnabled(logging::eDocDestroy))
>     logging::DocDestroy("document shutdown", mDocument, this);
> #endif
> 
>+  // Mark early since it seems ATs get lucky to call into us during shutdown.
>+  mFlags |= eIsDefunct;
>+
>   if (mNotificationController) {
>     mNotificationController->Shutdown();
>     mNotificationController = nsnull;
>   }
> 
>   RemoveEventListeners();
> 
>   // Mark the document as shutdown before AT is notified about the document

want to update this comment? or perhaps mark it as defunct here, to restore behavior from before making IsDefunct() inline?
(Assignee)

Comment 4

5 years ago
it's reasonable assumption since bug 737724 (inlinging IsDefunct()) is landed on 14 where the crash appeared.
(Assignee)

Comment 5

5 years ago
Created attachment 629249 [details] [diff] [review]
patch2
Attachment #629235 - Attachment is obsolete: true
Attachment #629235 - Flags: review?(trev.saunders)
Attachment #629249 - Flags: review?(trev.saunders)
Attachment #629249 - Flags: review?(trev.saunders) → review+
(Assignee)

Comment 6

5 years ago
https://hg.mozilla.org/integration/mozilla-inbound/rev/26b8f2292405
Target Milestone: --- → mozilla15
https://hg.mozilla.org/mozilla-central/rev/26b8f2292405
Status: ASSIGNED → RESOLVED
Last Resolved: 5 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.