Closed Bug 1789474 Opened 2 years ago Closed 2 years ago

Android Fission Crash in [@ mozilla::a11y::IDSet::ReleaseID]

Categories

(Core :: Disability Access APIs, defect)

Product:
Core
Component:
Disability Access APIs
Version:
Firefox 106
Platform:
All
Android
Type:
defect

Tracking

()

Status:
RESOLVED FIXED
Milestone:
108 Branch
Tracking Flags:
Tracking Status
firefox-esr102 --- unaffected
firefox104 --- disabled
firefox105 --- disabled
firefox106 --- disabled
firefox107 --- disabled
firefox108 --- fixed

People

(Reporter: jonalmeida, Assigned: eeejay)

References

(Blocks 1 open bug)

Details

(Keywords: crash, topcrash, Whiteboard: [fission:android:m2])

Crash Data

Attachments

(1 file)

Bug 1789474 - Allow detached documents to be overwritten in accessible mapping. r?Jamie
(deleted), text/x-phabricator-request
Details

Crash stats link: https://crash-stats.mozilla.org/signature/?signature=mozilla%3A%3Aa11y%3A%3AIDSet%3A%3AReleaseID&date=%3E%3D2022-08-30T18%3A30%3A00.000Z&date=%3C2022-09-06T18%3A30%3A00.000Z&_sort=-date

Reported by a Reference Browser user here (but note that Fenix is also affected):

The crash happens when I have fission enabled, I'm using my galaxy tab s5e tablet os11 one ui 3.1 andriod in dex mode.

Crash Signature: [@ mozilla::a11y::IDSet::ReleaseID]
Summary: [a11y] Crash on mozilla::a11y::IDSet::ReleaseID → Crash in [@ mozilla::a11y::IDSet::ReleaseID]
Component: General → Disability Access APIs
Product: GeckoView → Core

That's a bit concerning. It suggests we're trying to unregister an id we already unregistered... or worse, we had an uninitialised id somehow. Eitan, any ideas?

Blocks: a11y-ctw
Flags: needinfo?(eitan)

123 out of 123 crash reports on Fenix Nightly 106 apparently have Fission enabled (by the user), which is surprising. In that case, I'll set status-firefox104 and status-firefox105 = disabled.

status-firefox104: --- → disabled
status-firefox105: --- → disabled
status-firefox106: --- → affected
Keywords: crash
Whiteboard: [fission:android:m2]
Summary: Crash in [@ mozilla::a11y::IDSet::ReleaseID] → (Android Fission?) Crash in [@ mozilla::a11y::IDSet::ReleaseID]
Assignee: nobody → eitan
Flags: needinfo?(eitan)
Severity: -- → S3

Also assure that unregistering an accessible removes the right one and
doesn't confuse the attached document with the detached one.

The bug is linked to a topcrash signature, which matches the following criterion:

  • Top 10 AArch64 and ARM crashes on nightly

:eeejay, could you consider increasing the severity of this top-crash bug?

For more information, please visit auto_nag documentation.

Flags: needinfo?(eitan)
Keywords: topcrash

This is not a topcrash that is critical. It is a pref that nightly and beta users may enable. It is not a problem in release.

Keywords: topcrash

The bug is linked to a topcrash signature, which matches the following criterion:

  • Top 10 AArch64 and ARM crashes on nightly

:eeejay, could you consider increasing the severity of this top-crash bug?

For more information, please visit auto_nag documentation.

Flags: needinfo?(eitan)
Keywords: topcrash

(In reply to Kevin Brosnan [:kbrosnan] from comment #5)

This is not a topcrash that is critical. It is a pref that nightly and beta users may enable. It is not a problem in release.

status-firefox106: affected → disabled
status-firefox107: --- → affected
Flags: needinfo?(eitan)
Summary: (Android Fission?) Crash in [@ mozilla::a11y::IDSet::ReleaseID] → Android Fission Crash in [@ mozilla::a11y::IDSet::ReleaseID]

If we remove the topcrash keyword, autonag will just add it back. If we leave the topcrash keyword, autonag will complain that this "top" crash is should have a higher severity. So I'll just bump the severity from S3 to S2 to make autonag happy. Let's see if autonag complains that an S2 bug should have a higher priority.

Pushed by eisaacson@mozilla.com: https://hg.mozilla.org/integration/autoland/rev/431649004dd4 Allow detached documents to be overwritten in accessible mapping. r=Jamie,geckoview-reviewers,owlish

https://hg.mozilla.org/mozilla-central/rev/431649004dd4

Status: NEW → RESOLVED
Closed: 2 years ago
status-firefox107: affected → fixed
Resolution: --- → FIXED
Target Milestone: --- → 107 Branch

Backed out for causing android gv-junit-fis-o crashes

Backout link: https://hg.mozilla.org/integration/autoland/rev/ab68ea19b50955d3de6e50e3692cfbda22b433ad

Push with failures

Failure log #1

Status: RESOLVED → REOPENED
status-firefox107: fixed → ---
Flags: needinfo?(eitan)
Resolution: FIXED → ---
Target Milestone: 107 Branch → ---
Pushed by eisaacson@mozilla.com: https://hg.mozilla.org/integration/autoland/rev/df6223f933ae Allow detached documents to be overwritten in accessible mapping. r=Jamie,geckoview-reviewers,owlish

https://hg.mozilla.org/mozilla-central/rev/df6223f933ae

Status: REOPENED → RESOLVED
Closed: 2 years ago → 2 years ago
status-firefox108: affected → fixed
Resolution: --- → FIXED
Target Milestone: --- → 108 Branch
Flags: needinfo?(eitan)
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: