772782 - crash in DocAccessible::Shutdown @ NotificationController::Shutdown

Status: RESOLVED FIXED

(Core :: Disability Access APIs, defect)

Description

[Scoobidiver (away)]

There's one crash in 16.0a1/20120710:
Signature 	NotificationController::Shutdown More Reports Search
UUID	417b23ee-0065-45a7-addb-484362120710
Date Processed	2012-07-10 18:36:13
Uptime	572
Last Crash	2.2 days before submission
Install Age	2.9 hours since version was first installed.
Install Time	2012-07-10 15:39:17
Product	FennecAndroid
Version	16.0a1
Build ID	20120710030551
Release Channel	nightly
OS	Linux
OS Version	0.0.0 Linux 3.1.10-01872-g764d388-dirty #364 PREEMPT Mon Jun 18 12:20:58 CEST 2012 armv7l
Build Architecture	arm
Build Architecture Info	
Crash Reason	SIGSEGV
Crash Address	0x160
App Notes 	
AdapterDescription: 'Imagination Technologies -- PowerVR SGX 540 -- OpenGL ES 2.0 build 1.8@785978 -- Model: GT-I9000, Product: GT-I9000, Manufacturer: samsung, Hardware: aries'
EGL? EGL+ GL Context? GL Context+ GL Layers? GL Layers+ 
samsung GT-I9000
samsung/full_galaxysmtd/galaxysmtd:4.0.4/IMM76D/eng.ar.20120201.181605:user/release-keys
Processor Notes 	This dump is too long and has triggered the automatic truncation routine
EMCheckCompatibility	True
Adapter Vendor ID	Imagination Technologies
Adapter Device ID	PowerVR SGX 540

Frame 	Module 	Signature 	Source
0 	libxul.so 	NotificationController::Shutdown 	nsIPresShell.h:1283
1 	libxul.so 	DocAccessible::Shutdown 	accessible/src/generic/DocAccessible.cpp:639
2 	libxul.so 	nsAccDocManager::HandleEvent 	accessible/src/base/nsAccDocManager.cpp:283
3 	libxul.so 	nsEventListenerManager::HandleEventSubType 	content/events/src/nsEventListenerManager.cpp:820
4 	libxul.so 	nsEventListenerManager::HandleEventInternal 	content/events/src/nsEventListenerManager.cpp:893
5 	libxul.so 	nsEventTargetChainItem::HandleEvent 	content/events/src/nsEventListenerManager.h:143
6 	libxul.so 	nsEventTargetChainItem::HandleEventTargetChain 	content/events/src/nsEventDispatcher.cpp:286
7 	libxul.so 	nsEventDispatcher::Dispatch 	content/events/src/nsEventDispatcher.cpp:639
8 	libxul.so 	nsEventDispatcher::DispatchDOMEvent 	content/events/src/nsEventDispatcher.cpp:701
9 	libxul.so 	nsDocument::DispatchPageTransition 	content/base/src/nsDocument.cpp:7205
10 	libxul.so 	nsDocument::OnPageHide 	content/base/src/nsDocument.cpp:7316
11 	libxul.so 	DocumentViewerImpl::PageHide 	layout/base/nsDocumentViewer.cpp:1232
12 	libxul.so 	nsDocShell::FirePageHideNotification 	docshell/base/nsDocShell.cpp:1615
13 	libxul.so 	nsDocShell::Destroy 	docshell/base/nsDocShell.cpp:4691
14 	libxul.so 	nsFrameLoader::Finalize 	content/base/src/nsFrameLoader.cpp:544
15 	libxul.so 	nsDocument::MaybeInitializeFinalizeFrameLoaders 	content/base/src/nsDocument.cpp:5424
16 	libxul.so 	nsDocument::EndUpdate 	content/base/src/nsDocument.cpp:3963
17 	libxul.so 	nsXULDocument::EndUpdate 	content/xul/document/src/nsXULDocument.cpp:3302
18 	libxul.so 	mozAutoDocUpdate::~mozAutoDocUpdate 	content/base/src/mozAutoDocUpdate.h:35
19 	libxul.so 	nsINode::doRemoveChildAt 	content/base/src/nsINode.cpp:1365
20 	libxul.so 	nsGenericElement::RemoveChildAt 	content/base/src/nsGenericElement.cpp:2628
21 	libxul.so 	nsXULElement::RemoveChildAt 	content/xul/content/src/nsXULElement.cpp:941
22 	libxul.so 	nsINode::RemoveChild 	content/base/src/nsINode.cpp:453
23 	libxul.so 	nsIDOMNode_RemoveChild 	obj-firefox/js/xpconnect/src/dom_quickstubs.cpp:5358
24 	libxul.so 	js::InvokeKernel 	js/src/jscntxtinlines.h:400
25 	libxul.so 	js::Interpret 	js/src/jsinterp.cpp:2439
...

More reports at:
https://crash-stats.mozilla.com/report/list?signature=NotificationController%3A%3AShutdown

Comment 1

[Marco Zehe (:MarcoZ)]

Never seen this crash myself.

Comment 2

[David Bolter [:davidb] (NeedInfo me for attention)]

Eitan, any thoughts on this one?

Comment 3

[Eitan Isaacson [:eeejay]]

No, that looks like a tough one.

Comment 4

[alexander :surkov (:asurkov)]

It seems presshell is dead at this point (see http://hg.mozilla.org/mozilla-central/annotate/02b26fb307b4/layout/base/nsIPresShell.h#l1283). Boris, is that possible?

Comment 5

[Boris Zbarsky [:bzbarsky]]

Seems plausible: NotificationObserver just holds a weak ref, and we're tearing down the document...

Comment 6

[alexander :surkov (:asurkov)]

(In reply to Boris Zbarsky (:bz) from comment #5)
> Seems plausible: NotificationObserver just holds a weak ref, and we're
> tearing down the document...

presshell shutdowns the document accessible when presshell is destroyed (http://mxr.mozilla.org/mozilla-central/source/layout/base/nsPresShell.cpp#941). Then it should mean that somebody recreates the document after presshell destroyed and before the document tearing down.

Boris, can you take a look at the code where we create a document accessible (http://mxr.mozilla.org/mozilla-central/source/accessible/src/base/nsAccDocManager.cpp#351) and say how we can protect from that case please?

Comment 7

[Boris Zbarsky [:bzbarsky]]

> Then it should mean that somebody recreates the document after presshell destroyed and
> before the document tearing down.

I'm not sure what you mean there.

Comment 8

[Boris Zbarsky [:bzbarsky]]

Oh, someone recreates the mAccDocument?

You could refuse to let it be created if there is no presshell or if it's being destroyed...

Comment 9

[alexander :surkov (:asurkov)]

(In reply to Boris Zbarsky (:bz) from comment #8)
> Oh, someone recreates the mAccDocument?

yes

> You could refuse to let it be created if there is no presshell or if it's
> being destroyed...

we have checks (http://mxr.mozilla.org/mozilla-central/source/accessible/src/base/nsAccDocManager.cpp#351):

nsIPresShell* presShell = aDocument->GetShell();
if (!presShell || !presShell->GetRootFrame())

I guess it doesn't allow to handle destroyed presshell. What else should we have?

Comment 10

[Boris Zbarsky [:bzbarsky]]

Check IsDestroying()?

Comment 11

[alexander :surkov (:asurkov)]

(In reply to Boris Zbarsky (:bz) from comment #10)
> Check IsDestroying()?

ok, thank you

Comment 12

[Andrew Quartey [:drexler]]

Attachment: patch

Comment 13

[alexander :surkov (:asurkov)]

Comment on attachment 656701 [details] [diff] [review]
patch

Review of attachment 656701 [details] [diff] [review]:
-----------------------------------------------------------------

r=me, thank you. Andrew, do you need any help to land it?

Comment 14

[Andrew Quartey [:drexler]]

http://hg.mozilla.org/integration/mozilla-inbound/rev/0e1c6122fa93

Comment 15

[Ed Morley [:emorley]]

https://hg.mozilla.org/mozilla-central/rev/0e1c6122fa93