New issue
Advanced search Search tips

Issue 591752 link

Starred by 2 users

Issue metadata

Status: Fixed
Owner:
Closed: Mar 2016
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: ----
Pri: 2
Type: Bug
Team-Accessibility

Blocking:
issue 591715



Sign in to add a comment

[md] linux - crash in AutomationApiTest.Desktop

Project Member Reported by est...@chromium.org, Mar 3 2016

Issue description

Program received signal SIGSEGV, Segmentation fault.
0x0000000004d7ca36 in views::AXAuraObjCache::GetFocus() ()
(gdb) bt
#0  0x0000000004d7ca36 in views::AXAuraObjCache::GetFocus() ()
#1  0x0000000001d4f388 in AXTreeSourceAura::GetTreeData() const ()
#2  0x0000000001d4d71f in ui::AXTreeSerializer<views::AXAuraObjWrapper*, ui::AXNodeData, ui::AXTreeData>::SerializeChanges(views::AXAuraObjWrapper*, ui::AXTreeUpdateBase<ui::AXNodeData, ui::AXTreeData>*) ()
#3  0x0000000001d4cf46 in AutomationManagerAura::SendEvent(content::BrowserContext*, views::AXAuraObjWrapper*, ui::AXEvent) ()
#4  0x0000000001d4d2e3 in AutomationManagerAura::HandleEvent(content::BrowserContext*, views::View*, ui::AXEvent) ()
#5  0x0000000001ab5172 in views::View::SetVisible(bool) ()
#6  0x0000000004d6be8a in views::InkDropAnimationControllerImpl::~InkDropAnimationControllerImpl() ()
#7  0x0000000004d6bf29 in views::InkDropAnimationControllerImpl::~InkDropAnimationControllerImpl() ()
#8  0x0000000004d6baae in views::ButtonInkDropDelegate::~ButtonInkDropDelegate() ()
#9  0x0000000001bacb1f in ToolbarButton::~ToolbarButton() ()
#10 0x0000000001bacc09 in ToolbarButton::~ToolbarButton() ()
#11 0x0000000001ab36f3 in views::View::~View() ()
#12 0x0000000001badb59 in ToolbarView::~ToolbarView() ()
#13 0x0000000001ab36f3 in views::View::~View() ()
#14 0x0000000001603499 in TitleCard::~TitleCard() ()
#15 0x0000000001ab43c5 in views::View::RemoveAllChildViews(bool) ()
#16 0x0000000001b698b7 in BrowserView::~BrowserView() ()
#17 0x0000000001b69bd0 in non-virtual thunk to BrowserView::~BrowserView() ()
#18 0x0000000001ab36f3 in views::View::~View() ()
#19 0x0000000001ac35c7 in views::NonClientView::~NonClientView() ()
#20 0x0000000001ac3659 in views::NonClientView::~NonClientView() ()
#21 0x0000000001ab43c5 in views::View::RemoveAllChildViews(bool) ()
#22 0x0000000001aee7e2 in views::internal::RootView::~RootView() ()
#23 0x0000000001ae2389 in views::internal::RootView::~RootView() ()
#24 0x0000000001aba57b in views::Widget::~Widget() ()
#25 0x0000000001b68069 in BrowserFrame::~BrowserFrame() ()
#26 0x0000000001af4c0b in views::DesktopNativeWidgetAura::~DesktopNativeWidgetAura() ()
#27 0x0000000001d68fd6 in DesktopBrowserFrameAuraLinux::~DesktopBrowserFrameAuraLinux() ()
#28 0x0000000001acab20 in views::DesktopWindowTreeHostX11::CloseNow() ()
#29 0x000000000072928c in base::internal::Invoker<base::IndexSequence<0ul>, base::internal::BindState<base::internal::RunnableAdapter<void (base::RunLoop::*)()>, void (base::RunLoop*), base::WeakPtr<base::RunLoop> >, base::internal::InvokeHelper<true, void, base::internal::RunnableAdapter<void (base::RunLoop::*)()> >, void ()>::Run(base::internal::BindStateBase*) ()
#30 0x000000000169435c in base::debug::TaskAnnotator::RunTask(char const*, base::PendingTask const&) ()
#31 0x0000000001643d4b in base::MessageLoop::RunTask(base::PendingTask const&) ()
#32 0x0000000001644038 in base::MessageLoop::DeferOrRunPendingTask(base::PendingTask const&) ()
#33 0x00000000016441eb in base::MessageLoop::DoWork() ()
#34 0x0000000001692af9 in base::MessagePumpGlib::Run(base::MessagePump::Delegate*) ()
#35 0x00000000016586c0 in base::RunLoop::Run() ()
#36 0x000000000490022c in content::RunThisRunLoop(base::RunLoop*) ()
#37 0x00000000049001ca in content::RunMessageLoop() ()
#38 0x000000000161ea81 in InProcessBrowserTest::QuitBrowsers() ()
#39 0x000000000161e7fd in InProcessBrowserTest::RunTestOnMainThreadLoop() ()
#40 0x00000000016bd5ca in content::BrowserTestBase::ProxyRunTestOnMainThreadLoop() ()
#41 0x000000000151a364 in ChromeBrowserMainParts::PreMainMessageLoopRunImpl() ()
#42 0x0000000001518f9c in ChromeBrowserMainParts::PreMainMessageLoopRun() ()
#43 0x0000000003a13d8c in content::BrowserMainLoop::PreMainMessageLoopRun() ()
#44 0x0000000003b3f077 in content::StartupTaskRunner::RunAllTasksNow() ()
#45 0x0000000003a12230 in content::BrowserMainLoop::CreateStartupTasks() ()
#46 0x0000000003c032ea in content::BrowserMainRunnerImpl::Initialize(content::MainFunctionParams const&) ()
#47 0x0000000005503006 in content::BrowserMain(content::MainFunctionParams const&) ()
#48 0x00000000048e4a52 in content::ContentMainRunnerImpl::Run() ()
#49 0x00000000048e37d0 in content::ContentMain(content::ContentMainParams const&) ()
#50 0x00000000016bd113 in content::BrowserTestBase::SetUp() ()
#51 0x000000000161ce86 in InProcessBrowserTest::SetUp() ()
#52 0x000000000194b158 in testing::Test::Run() ()
#53 0x000000000194c0ea in testing::TestInfo::Run() ()
#54 0x000000000194c573 in testing::TestCase::Run() ()
#55 0x0000000001953709 in testing::internal::UnitTestImpl::RunAllTests() ()
#56 0x00000000019533ae in testing::UnitTest::Run() ()
#57 0x00000000016a3a71 in base::TestSuite::Run() ()
#58 0x0000000001070249 in ChromeBrowserTestSuiteRunner::RunTestSuite(int, char**) ()
#59 0x00000000048fd2a1 in content::LaunchTests(content::TestLauncherDelegate*, int, int, char**) ()
#60 0x000000000160539a in LaunchChromeTests(int, ChromeTestSuiteRunner*, int, char**) ()
#61 0x0000000001070219 in main ()
 
Cc: dmazz...@chromium.org
I think this is from this change:

https://codereview.chromium.org/1589623002

as far as I can tell, there's no guarantee that focus_client_ outlives AXAuraObjCache and there's no notification when it gets destroyed.
Blocking: 591715
Components: UI>Accessibility
Labels: Stability-Crash
a potential fix is here: https://codereview.chromium.org/1589623002
Currently I know of a crash in MD mode, which is not on by default in M50. But this should probably be merged to m50 nonetheless because there may be other ways to trigger it.
Project Member

Comment 4 by bugdroid1@chromium.org, Mar 3 2016

Labels: Merge-Request-50
Status: Fixed (was: Assigned)

Comment 6 by tin...@google.com, Mar 8 2016

Labels: -Merge-Request-50 Merge-Approved-50 Hotlist-Merge-Approved
Your change meets the bar and is auto-approved for M50 (branch: 2661)
Project Member

Comment 7 by bugdroid1@chromium.org, Mar 8 2016

Labels: -merge-approved-50 merge-merged-2661
The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/ced164430fe24ee35284d0354e966874c89e479c

commit ced164430fe24ee35284d0354e966874c89e479c
Author: Evan Stade <estade@chromium.org>
Date: Tue Mar 08 01:48:25 2016

AXAuraObjCache - clear focus client reference when window is destroyed

BUG= 591752 

Review URL: https://codereview.chromium.org/1765583002

Cr-Commit-Position: refs/heads/master@{#379087}
(cherry picked from commit 3913fbd60c13692088faf71adc52294bff9a9f0b)

Review URL: https://codereview.chromium.org/1767383002 .

Cr-Commit-Position: refs/branch-heads/2661@{#121}
Cr-Branched-From: ef6f6ae5e4c96622286b563658d5cd62a6cf1197-refs/heads/master@{#378081}

[modify] https://crrev.com/ced164430fe24ee35284d0354e966874c89e479c/ui/views/accessibility/ax_aura_obj_cache.cc
[modify] https://crrev.com/ced164430fe24ee35284d0354e966874c89e479c/ui/views/accessibility/ax_aura_obj_cache.h

Sign in to add a comment