779645 - dangling ptr crash w/ uia in NotificationController::ContentInsertion::Process

Status: RESOLVED INVALID

(Core :: Disability Access APIs, defect)

Description

[Jim Mathies [:jimm]]

Not sure what the cause of this is, but here's the data thus far:

Normal insertion scheduling runs like so according to some debug output I've added:

[8A76CA8] NotificationController::ScheduleContentInsertion ContentInsertion=84D9CB8
[8A76CA8] NotificationController::WillRefresh DocAccessible=8711620
[8A76CA8] NotificationController::WillRefresh (pre Process) DocAccessible=8711620
NotificationController::ContentInsertion::Process() mDocument=8711620
NotificationController::ContentInsertion::Process() mDocument=8711620
NotificationController::ContentInsertion::Process() mDocument=8711620
NotificationController::ContentInsertion::Process() mDocument=8711620
[8A76CA8] NotificationController::WillRefresh (post Process) DocAccessible=8711620

but occasionally I see this:

[8488E90] NotificationController::WillRefresh DocAccessible=882E100
[8488E90] NotificationController::WillRefresh (pre Process) DocAccessible=882E100
NotificationController::ContentInsertion::Process() mDocument=882E100
[8711350] ~DocAccessible
[5AFA728] ~DocAccessible
[D9A1C90] ~DocAccessible
[8711620] ~DocAccessible
[882E100] ~DocAccessible
First-chance exception at 0x6729955E (msvcr110d.dll) in firefox.exe: 0xC0000005: Access violation reading location 0xDDDDDDD8.

The weak DocAccessible in ContentInsertion gets destroyed out from under it during this operation:

http://mxr.mozilla.org/mozilla-central/source/accessible/src/base/NotificationController.cpp#215

will attach a stack.

I tried keeping a strong ref to the DocAccessible just for kicks in ContentInsertion but that didn't seem to help.

To reproduce this you just have to interact a bit with the browser interface in win8.

Comment 1

[Jim Mathies [:jimm]]

Attachment: stack

Comment 2

[Jim Mathies [:jimm]]

I think I've solved this through some changes in widget related to querying for the root accessible.