757392 - crash in nsIDocument::GetRootElement mainly with JAWS 11

Status: RESOLVED FIXED

Description

[Marco Zehe (:MarcoZ)]

This bug was filed from the Socorro interface and is 
report bp-ed0a3edc-42e6-457a-b7f8-523c82120519 .
============================================================= 

Reported to me by a community member.

Comment 1

[Scoobidiver (away)]

It's a low volume crash that only affects JAWS 11 users at least in 14.0a2 and 15.0a1.

More reports at:
https://crash-stats.mozilla.com/report/list?signature=nsIDocument%3A%3AGetRootElement%28%29

Comment 2

[alexander :surkov (:asurkov)]

Created attachment 629235 [details] [diff] [review]
patch

no better ideas

Comment 3

[Trevor Saunders (:tbsaunde)]

Comment on attachment 629235 [details] [diff] [review]
patch

>diff --git a/accessible/src/generic/DocAccessible.cpp b/accessible/src/generic/DocAccessible.cpp
>--- a/accessible/src/generic/DocAccessible.cpp
>+++ b/accessible/src/generic/DocAccessible.cpp
>@@ -631,16 +631,19 @@ DocAccessible::Shutdown()
>   if (!mPresShell) // already shutdown
>     return;
> 
> #ifdef DEBUG
>   if (logging::IsEnabled(logging::eDocDestroy))
>     logging::DocDestroy("document shutdown", mDocument, this);
> #endif
> 
>+  // Mark early since it seems ATs get lucky to call into us during shutdown.
>+  mFlags |= eIsDefunct;
>+
>   if (mNotificationController) {
>     mNotificationController->Shutdown();
>     mNotificationController = nsnull;
>   }
> 
>   RemoveEventListeners();
> 
>   // Mark the document as shutdown before AT is notified about the document

want to update this comment? or perhaps mark it as defunct here, to restore behavior from before making IsDefunct() inline?

Comment 4

[alexander :surkov (:asurkov)]

it's reasonable assumption since bug 737724 (inlinging IsDefunct()) is landed on 14 where the crash appeared.

Comment 5

[alexander :surkov (:asurkov)]

Created attachment 629249 [details] [diff] [review]
patch2

Comment 6

[alexander :surkov (:asurkov)]

https://hg.mozilla.org/integration/mozilla-inbound/rev/26b8f2292405

Comment 7

[:Ehsan Akhgari]

https://hg.mozilla.org/mozilla-central/rev/26b8f2292405