857319 - crash in mozilla::a11y::sdnAccessible::Release

Status: RESOLVED DUPLICATE of bug 865240

(Core :: Disability Access APIs, defect)

Description

[Wayne Mery (:wsmwk)]

appears to be a regression - first appears in TB20


This bug was filed from the Socorro interface and is 
report bp-ee25405a-a39e-4789-b381-9a53a2130402 .
============================================================= 
0	mozglue.dll	moz_abort	memory/build/jemalloc_config.c:33
1	mozglue.dll	arena_run_reg_dalloc	memory/mozjemalloc/jemalloc.c:3336
2	mozglue.dll	arena_dalloc_small	memory/mozjemalloc/jemalloc.c:4540
3	mozglue.dll	arena_dalloc	memory/mozjemalloc/jemalloc.c:4668
4	mozglue.dll	je_free	memory/mozjemalloc/jemalloc.c:6589
5	xul.dll	mozilla::a11y::sdnAccessible::Release	accessible/src/windows/sdn/sdnAccessible.h:40 
6	gwm32inc.dll	gwm32inc.dll@0x3795	
7	gwm32inc.dll	gwm32inc.dll@0x758b	
8	gwm32inc.dll	gwm32inc.dll@0x12fbd	
9	gwm32inc.dll	gwm32inc.dll@0x34a98	
10	gwm32inc.dll	gwm32inc.dll@0x370a8	
11	gwm32inc.dll	gwm32inc.dll@0x371f7	
12	gwm32inc.dll	gwm32inc.dll@0x3731a	
13	user32.dll	__ClientCallWinEventProc	
14	ntdll.dll	KiUserCallbackDispatcher	
15	ntdll.dll	KiUserApcDispatcher	
16	xul.dll	NS_GetTraceRefcnt_P	xpcom/build/nsXPComInit.cpp:307
17	xul.dll	PL_DHashTableOperate	objdir-tb/mozilla/xpcom/build/pldhash.cpp:588
18	xul.dll	mozilla::a11y::Accessible::HandleAccEvent	accessible/src/generic/Accessible.cpp:1168
19	xul.dll	nsEventShell::FireEvent	accessible/src/base/nsEventShell.cpp:31
20	xul.dll	mozilla::a11y::NotificationController::ProcessEventQueue	accessible/src/base/NotificationController.cpp:726
21	xul.dll	mozilla::a11y::NotificationController::WillRefresh	accessible/src/base/NotificationController.cpp:306 

https://crash-stats.mozilla.com/report/list?product=Thunderbird&query_search=signature&query_type=exact&query=moz_abort%20|%20arena_run_reg_dalloc%20|%20arena_dalloc_small%20|%20arena_dalloc%20|%20je_free%20|%20mozilla%3A%3Aa11y%3A%3AsdnAccessible%3A%3ARelease%28%29&reason_type=contains&date=04%2F02%2F2013%2021%3A51%3A52&range_value=4&range_unit=weeks&hang_type=any&process_type=all&do_query=1&admin=1&signature=moz_abort%20|%20arena_run_reg_dalloc%20|%20arena_dalloc_small%20|%20arena_dalloc%20|%20je_free%20|%20mozilla%3A%3Aa11y%3A%3AsdnAccessible%3A%3ARelease%28%29

Comment 1

[Steve Pattison]

Hi,

I'm a blind person and I use a screen reader called Window-eyes available from www.gwmicro.com with Thunderbird. My operating system is Vista Home Premium Service Pack 1 32-bit. I have been having occasional crashes in Thunderbird and they appear to occur on a random basis. I hope this helps.

Regards Steve.

Comment 2

[alexander :surkov (:asurkov)]

Trev, cc somebody who knows COM and memory stuff? Should we have thread-safe release or something?

Comment 3

[Trevor Saunders (:tbsaunde)]

(In reply to alexander :surkov from comment #2)
> Trev, cc somebody who knows COM and memory stuff? Should we have thread-safe
> release or something?

no, poking at accessibles off the main thread won't work even with thread safe ref counting since they poke at the DOM and layout.  I suspect this is a window eyes bug at this point, can we get someone from GWMicro to look at it?

Comment 4

[alexander :surkov (:asurkov)]

CC'ing Doug

Comment 5

[Wayne Mery (:wsmwk)]

(In reply to alexander :surkov from comment #4)
> CC'ing Doug

No response from Doug

Perhaps the crash is gone?
Since March, there is only 6 crashes, 5 are version 21.0, one version 29 
bp-0d286de4-fd33-4836-8ed8-d40542140408
bp-cf85a35f-ec3e-482a-a299-958af2140228
bp-f5c49533-34de-435f-8347-756ea2140226
bp-113903e3-b71f-40c6-98b1-680f72140224
bp-fc6baf28-c7e2-4121-bbde-82e4d2140304
bp-1feb3412-ca19-417c-9d29-d1bb22140705

Comment 6

[Trevor Saunders (:tbsaunde)]

> Perhaps the crash is gone?
> Since March, there is only 6 crashes, 5 are version 21.0, one version 29 

I'd guess the 21.0 ones are bug 865240, and the 29 one is a mystery.

Comment 7

[Wayne Mery (:wsmwk)]

Thanks Trevor