1294500 - MOZ_ASSERT_UNREACHABLE() in DocAccessible.cpp introduced in bug 1246447 triggers in Thunderbird Mozmill tests.

Status: RESOLVED FIXED

(Core :: Disability Access APIs, defect)

Description

[Jorg K (CEST = GMT+2)]

+++ This bug was initially created as a clone of Bug #1246447 +++

After landing bug 1246447, the MOZ_ASSERT_UNREACHABLE() introduced here
https://hg.mozilla.org/mozilla-central/rev/662564091330#l1.13
is triggered in Thunderbird debug Mozmill runs, for example here:

https://treeherder.mozilla.org/#/jobs?repo=comm-central&revision=296d8c85035498adcf926310f49e00f83fda03c6
https://treeherder.mozilla.org/#/jobs?repo=comm-central&selectedJob=43826
https://treeherder.mozilla.org/#/jobs?repo=comm-central&selectedJob=43818

Assertion failure: false (MOZ_ASSERT_UNREACHABLE: DOM attribute change on accessible detached from tree), at /builds/slave/tb-c-cen-l64-d-000000000000000/build/mozilla/accessible/generic/DocAccessible.cpp:768

This affects Linux and Windows, I assume also Mac, but on Mac the crash is obscured by another crash, see bug 1293759.

The test that appears to cause the problem on the servers is test-header-toolbar.js which can be run locally from the object directory via:
mozmake SOLO_TEST=message-header/test-header-toolbar.js mozmill-one
However, the crash doesn't seem to happen in a local build when the test is run locally.

Comment 1

[Jorg K (CEST = GMT+2)]

Aceman, can you reproduce this locally?

Comment 2

[:aceman]

No, I think I tried it but can't reproduce it. Can we trace it to at least a code block in the test which triggers this error? Maybe we could then find out what it does on an element "detached from tree".

Comment 3

[Jorg K (CEST = GMT+2)]

Alexander, what does it mean to be "detached from tree"?
https://hg.mozilla.org/mozilla-central/rev/662564091330#l1.13

Why is that unexpected and why does that have to trigger an assert?

Basically all of our debug Mozmill tests fail due to this problem which greatly reduces our test coverage.

Comment 4

[alexander :surkov (:asurkov)]

(In reply to Jorg K (GMT+2, PTO during summer) from comment #3)
> Alexander, what does it mean to be "detached from tree"?
> https://hg.mozilla.org/mozilla-central/rev/662564091330#l1.13

when accessible is not in the accessible tree (has no parent)

> Why is that unexpected and why does that have to trigger an assert?

'not in tree' accessible shouldn't be available via DocAccessilbe::GetAccessilbe(), such accessible is something that should be destroyed soon.

I hoped to debug myself but wasn't able to reproduce it. If I add more logging, then will you able to turn it on for the test, either by invoking JS or by setting up environment variable?

btw, do we have a stack?

Comment 5

[Jorg K (CEST = GMT+2)]

(In reply to alexander :surkov from comment #4)
> I hoped to debug myself but wasn't able to reproduce it. If I add more
> logging, then will you able to turn it on for the test, either by invoking
> JS or by setting up environment variable?
You can simply give me a patch and I can do a try run with your patch. Just hard-code the logging.

> btw, do we have a stack?
Plenty, but not all that useful. Quoting from:
https://archive.mozilla.org/pub/thunderbird/tinderbox-builds/comm-central-macosx64-debug/1471414694/comm-central_yosemite_r7-debug_test-mozmill-bm135-tests1-macosx-build11.txt.gz
01:03:41     INFO -  Assertion failure: false (MOZ_ASSERT_UNREACHABLE: DOM attribute change on accessible detached from tree), at /builds/slave/tb-c-cen-m64-d-000000000000000/build/mozilla/accessible/generic/DocAccessible.cpp:768
01:03:41     INFO -  #01: imgLoader::SupportImageWithMimeType(char const*, AcceptedMimeTypes)[/builds/slave/test/build/application/DailyDebug.app/Contents/MacOS/XUL +0x188f933]
01:03:41     INFO -  #02: imgLoader::SupportImageWithMimeType(char const*, AcceptedMimeTypes)[/builds/slave/test/build/application/DailyDebug.app/Contents/MacOS/XUL +0x170b990]
01:03:41     INFO -  #03: imgLoader::SupportImageWithMimeType(char const*, AcceptedMimeTypes)[/builds/slave/test/build/application/DailyDebug.app/Contents/MacOS/XUL +0x170b2b5]
01:03:41     INFO -  #04: imgLoader::SupportImageWithMimeType(char const*, AcceptedMimeTypes)[/builds/slave/test/build/application/DailyDebug.app/Contents/MacOS/XUL +0x293e591]
01:03:41     INFO -  #05: imgLoader::SupportImageWithMimeType(char const*, AcceptedMimeTypes)[/builds/slave/test/build/application/DailyDebug.app/Contents/MacOS/XUL +0x24c0241]
01:03:41     INFO -  #06: imgLoader::SupportImageWithMimeType(char const*, AcceptedMimeTypes)[/builds/slave/test/build/application/DailyDebug.app/Contents/MacOS/XUL +0x25c1976]

Or you can check the Windows versions:
https://archive.mozilla.org/pub/thunderbird/tinderbox-builds/comm-central-win32-debug/1471414694/comm-central_win7_ix-debug_test-mozmill-bm111-tests1-windows-build0.txt.gz
01:35:37     INFO -  Assertion failure: false (MOZ_ASSERT_UNREACHABLE: DOM attribute change on accessible detached from tree), at c:/builds/moz2_slave/tb-c-cen-w32-d-000000000000000/build/mozilla/accessible/generic/DocAccessible.cpp:768
01:35:37     INFO -  #01: imgLoader::SupportImageWithMimeType[C:\slave\test\build\application\thunderbird\xul.dll +0x11365d1]
01:35:37     INFO -  #02: imgLoader::SupportImageWithMimeType[C:\slave\test\build\application\thunderbird\xul.dll +0x1072d21]
01:35:37     INFO -  #03: imgLoader::SupportImageWithMimeType[C:\slave\test\build\application\thunderbird\xul.dll +0x1072765]
01:35:37     INFO -  #04: imgLoader::SupportImageWithMimeType[C:\slave\test\build\application\thunderbird\xul.dll +0x1ab6152]
01:35:37     INFO -  #05: imgLoader::SupportImageWithMimeType[C:\slave\test\build\application\thunderbird\xul.dll +0x10725bc]
01:35:37     INFO -  #06: imgLoader::SupportImageWithMimeType[C:\slave\test\build\application\thunderbird\xul.dll +0x17faed1]
01:35:37     INFO -  #07: imgLoader::SupportImageWithMimeType[C:\slave\test\build\application\thunderbird\xul.dll +0x180ce99]
01:35:37     INFO -  #08: imgLoader::SupportImageWithMimeType[C:\slave\test\build\application\thunderbird\xul.dll +0x18b7f15]
01:35:37     INFO -  #09: mozilla::scache::PathifyURI[C:\slave\test\build\application\thunderbird\xul.dll +0x312e896]
01:35:37     INFO -  #10: mozilla::scache::PathifyURI[C:\slave\test\build\application\thunderbird\xul.dll +0x3137526]
01:35:37     INFO -  #11: mozilla::scache::PathifyURI[C:\slave\test\build\application\thunderbird\xul.dll +0x31371a9]
01:35:37     INFO -  #12: mozilla::scache::PathifyURI[C:\slave\test\build\application\thunderbird\xul.dll +0x312edb3]

Comment 6

[alexander :surkov (:asurkov)]

Attachment: try

could you run this please and see if it helps

Comment 7

[Jorg K (CEST = GMT+2)]

Done.
https://treeherder.mozilla.org/#/jobs?repo=try-comm-central&revision=cdcaab9fc239

As you know M-C is included in C-C under /mozilla. We have a "complicated" process to do pushes with changes to M-C to our try server. I will spare you the details.

The top three changeset in the push will do it, fingers crossed. I'll be back when I have the results.

Comment 8

[Jorg K (CEST = GMT+2)]

I think your patch fixes the problem.

So far one Mozmill test that failed previously came out green:
https://treeherder.mozilla.org/#/jobs?repo=try-comm-central&revision=cdcaab9fc239

Comment 9

[alexander :surkov (:asurkov)]

Attachment: patch

can you check this a try as well please?

Comment 10

[Jorg K (CEST = GMT+2)]

(In reply to alexander :surkov from comment #9)
> can you check this a try as well please?
Sadly the Linux runs showed some other errors, but at least the crash is gone.

Here another try with the patch your presented for review:
https://treeherder.mozilla.org/#/jobs?repo=try-comm-central&revision=ee9846f9f6d2
(It's after midnight here now, so check at your own leisure. I'll be back in the morning.)

Comment 11

[Jorg K (CEST = GMT+2)]

That second patch worked, too. Given that you've already asked for review, I hope it will land soon.

Thanks for your support!

Comment 12

[Yura Zenevich [:yzen] (please use "needinfo")]

Comment on attachment 8782130 [details] [diff] [review]
patch

Review of attachment 8782130 [details] [diff] [review]:
-----------------------------------------------------------------

Looks good thanks!

Comment 13

[alexander :surkov (:asurkov)]

https://hg.mozilla.org/integration/mozilla-inbound/rev/096df9a5fcda28460e26d63834d0fb9e347fbed1
Bug 1294500 - MOZ_ASSERT_UNREACHABLE() in DocAccessible.cpp introduced in bug 1246447 triggers in Thunderbird, r=yzen

Comment 14

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/096df9a5fcda