Last Comment Bug 757392 - crash in nsIDocument::GetRootElement mainly with JAWS 11
: crash in nsIDocument::GetRootElement mainly with JAWS 11
Status: RESOLVED FIXED
: crash
Product: Core
Classification: Components
Component: Disability Access APIs (show other bugs)
: 14 Branch
: x86 Windows NT
: -- critical (vote)
: mozilla15
Assigned To: alexander :surkov
:
Mentors:
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2012-05-22 04:05 PDT by Marco Zehe (:MarcoZ)
Modified: 2012-06-02 12:27 PDT (History)
3 users (show)
See Also:
Crash Signature:
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments
patch (765 bytes, patch)
2012-06-01 10:26 PDT, alexander :surkov
no flags Details | Diff | Review
patch2 (934 bytes, patch)
2012-06-01 10:57 PDT, alexander :surkov
tbsaunde+mozbugs: review+
Details | Diff | Review

Description Marco Zehe (:MarcoZ) 2012-05-22 04:05:27 PDT
This bug was filed from the Socorro interface and is 
report bp-ed0a3edc-42e6-457a-b7f8-523c82120519 .
============================================================= 

Reported to me by a community member.
Comment 1 Scoobidiver (away) 2012-05-22 04:42:19 PDT
It's a low volume crash that only affects JAWS 11 users at least in 14.0a2 and 15.0a1.

More reports at:
https://crash-stats.mozilla.com/report/list?signature=nsIDocument%3A%3AGetRootElement%28%29
Comment 2 alexander :surkov 2012-06-01 10:26:41 PDT
Created attachment 629235 [details] [diff] [review]
patch

no better ideas
Comment 3 Trevor Saunders (:tbsaunde) 2012-06-01 10:39:05 PDT
Comment on attachment 629235 [details] [diff] [review]
patch

>diff --git a/accessible/src/generic/DocAccessible.cpp b/accessible/src/generic/DocAccessible.cpp
>--- a/accessible/src/generic/DocAccessible.cpp
>+++ b/accessible/src/generic/DocAccessible.cpp
>@@ -631,16 +631,19 @@ DocAccessible::Shutdown()
>   if (!mPresShell) // already shutdown
>     return;
> 
> #ifdef DEBUG
>   if (logging::IsEnabled(logging::eDocDestroy))
>     logging::DocDestroy("document shutdown", mDocument, this);
> #endif
> 
>+  // Mark early since it seems ATs get lucky to call into us during shutdown.
>+  mFlags |= eIsDefunct;
>+
>   if (mNotificationController) {
>     mNotificationController->Shutdown();
>     mNotificationController = nsnull;
>   }
> 
>   RemoveEventListeners();
> 
>   // Mark the document as shutdown before AT is notified about the document

want to update this comment? or perhaps mark it as defunct here, to restore behavior from before making IsDefunct() inline?
Comment 4 alexander :surkov 2012-06-01 10:56:40 PDT
it's reasonable assumption since bug 737724 (inlinging IsDefunct()) is landed on 14 where the crash appeared.
Comment 5 alexander :surkov 2012-06-01 10:57:18 PDT
Created attachment 629249 [details] [diff] [review]
patch2
Comment 7 :Ehsan Akhgari (busy, don't ask for review please) 2012-06-02 12:27:04 PDT
https://hg.mozilla.org/mozilla-central/rev/26b8f2292405

Note You need to log in before you can comment on or make changes to this bug.