Mats Palmgren (inactive) Reporter
	Description • 9 years ago

This bug was filed from the Socorro interface and is 
report bp-a239e39e-0b10-4ca5-bd15-c76692151008.
=============================================================

Appears to be a recent regression in v43 and v44.  The first crash report
I can find is for build 2015091703.  It's the #2 Top Crash in v43.
The crash occurs on all platforms.

The stack looks similar to bug 1187055.

PLDHashTable::Remove(void const*)
mozilla::a11y::ProxyDestroyed(mozilla::a11y::ProxyAccessible*)
mozilla::a11y::DocAccessibleParent::Destroy()
mozilla::a11y::DocAccessibleParent::ActorDestroy(mozilla::ipc::IProtocolManager<mozilla::ipc::IProtocol>::ActorDestroyReason)
mozilla::a11y::PDocAccessibleParent::DestroySubtree(mozilla::ipc::IProtocolManager<mozilla::ipc::IProtocol>::ActorDestroyReason)
mozilla::dom::PBrowserParent::DestroySubtree(mozilla::ipc::IProtocolManager<mozilla::ipc::IProtocol>::ActorDestroyReason)
mozilla::dom::PContentParent::DestroySubtree(mozilla::ipc::IProtocolManager<mozilla::ipc::IProtocol>::ActorDestroyReason)
mozilla::dom::PContentParent::OnChannelError()
...

More Reports:
https://crash-stats.mozilla.com/report/list?product=Firefox&signature=PLDHashTable%3A%3ARemove%28void+const%2A%29

	Mats Palmgren (inactive) Reporter
	Comment 1 • 9 years ago

[Tracking Requested - why for this release]: recent crash regression (topcrash)

	Liz Henry (:lizzard) (relman/hg->git project)
	Comment 2 • 9 years ago

This is the #1 topcrash for 43. 

Trevor, since you worked on bug 1187055, do you want to have a crack at this one?

	Trevor Saunders (:tbsaunde) Assignee
	Comment 3 • 9 years ago

> Appears to be a recent regression in v43 and v44.  The first crash report
> I can find is for build 2015091703.  It's the #2 Top Crash in v43.
> The crash occurs on all platforms.

actually I'm pretty sure its windows only.  The only linux crashes I could find were some dom/quota bug that got misscategorized because of having the same first stack frame.  The code that crashes is also windows only so that seems like a good reason to think it doesn't effect anything else.


(In reply to Liz Henry (:lizzard) (needinfo? me) from comment #2)
> This is the #1 topcrash for 43. 
> 
> Trevor, since you worked on bug 1187055, do you want to have a crack at this
> one?

well, I don't have an idea how it can happen, but I can work around it I think.

	Andreas Tolfsen ❲:ato❳
	Comment 4 • 9 years ago

I experienced this crash on a Mac.

	Andreas Tolfsen ❲:ato❳
	Comment 5 • 9 years ago

That was https://crash-stats.mozilla.com/report/index/3c6c2c34-fee3-408b-9014-116022151013

	David Bolter [:davidb] (NeedInfo me for attention)
	Comment 8 • 9 years ago

Comment on attachment 8673694 [details] [diff] [review]
assert that we don't destroy a document's proxy until we destroy all of its children

Review of attachment 8673694 [details] [diff] [review]:
-----------------------------------------------------------------

::: accessible/ipc/DocAccessibleParent.cpp
@@ +261,5 @@
>    for (uint32_t i = childDocCount - 1; i < childDocCount; i--)
>      mChildDocs[i]->Destroy();
>  
>    for (auto iter = mAccessibles.Iter(); !iter.Done(); iter.Next()) {
> +    MOZ_ASSERT(iter.Get()->mProxy != this);

I... ok...

	Pulsebot
	Comment 9 • 9 years ago

https://hg.mozilla.org/integration/mozilla-inbound/rev/01779f96009b
https://hg.mozilla.org/integration/mozilla-inbound/rev/4b7985e5a345

	Carsten Book [:Tomcat]
	Comment 10 • 9 years ago

https://hg.mozilla.org/mozilla-central/rev/01779f96009b
https://hg.mozilla.org/mozilla-central/rev/4b7985e5a345

	Liz Henry (:lizzard) (relman/hg->git project)
	Comment 11 • 9 years ago

Can you request uplift for this, to aurora? Thanks!

	Trevor Saunders (:tbsaunde) Assignee
	Comment 12 • 9 years ago

Comment on attachment 8673695 [details] [diff] [review]
work around proxy's that don't have a wrapper for their document

Approval Request Comment
[Feature/regressing bug #]:e10s a11y work with windows events
[User impact if declined]:crashes
[Describe test coverage new/current, TreeHerder]:landed m-c so for a while with no known issues
[Risks and why]:  low basically just a null check
[String/UUID change made/needed]: none

	Liz Henry (:lizzard) (relman/hg->git project)
	Comment 13 • 9 years ago

Comment on attachment 8673695 [details] [diff] [review]
work around proxy's that don't have a wrapper for their document

Fix for topcrash, ok on m-c; ok to uplift to aurora.

	Carsten Book [:Tomcat]
	Comment 14 • 9 years ago

https://hg.mozilla.org/releases/mozilla-aurora/rev/42c40ea06488