1370669 - Assertion failure: mTable.GetWeak(addr) == aEvent [@ mozilla::a11y::NotificationController::EventMap::RemoveEvent]

Status: RESOLVED FIXED

(Core :: Disability Access APIs, defect, P3)

Description

[Tyson Smith [:tsmith]]

Attachment: test_case.html

Assertion failure: mTable.GetWeak(addr) == aEvent (mTable has the wrong event), at src/accessible/base/NotificationController.cpp:935

This test case requires fuzzPriv extension is required. It can be found here https://github.com/MozillaSecurity/domfuzz/tree/master/dom/extension

e10s was disabled when this assertion was discovered.

#0 0x7fb03c35d069 in mozilla::a11y::NotificationController::EventMap::RemoveEvent(mozilla::a11y::AccTreeMutationEvent*) src/accessible/base/NotificationController.cpp:932:3
#1 0x7fb03c35ee7c in mozilla::a11y::NotificationController::WillRefresh(mozilla::TimeStamp) src/accessible/base/NotificationController.cpp:850:18
#2 0x7fb03a1ec35f in nsRefreshDriver::Tick(long, mozilla::TimeStamp) src/layout/base/nsRefreshDriver.cpp:1790:12
#3 0x7fb03a1f514e in mozilla::RefreshDriverTimer::TickRefreshDrivers(long, mozilla::TimeStamp, nsTArray<RefPtr<nsRefreshDriver> >&) src/layout/base/nsRefreshDriver.cpp:300:7
#4 0x7fb03a1f4f1d in mozilla::RefreshDriverTimer::Tick(long, mozilla::TimeStamp) src/layout/base/nsRefreshDriver.cpp:321:5
#5 0x7fb03a1f8d65 in mozilla::VsyncRefreshDriverTimer::RunRefreshDrivers(mozilla::TimeStamp) src/layout/base/nsRefreshDriver.cpp:753:5
#6 0x7fb03a1f7886 in mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::TickRefreshDriver(mozilla::TimeStamp) src/layout/base/nsRefreshDriver.cpp:666:35
#7 0x7fb03a1f3537 in mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::ParentProcessVsyncNotifier::Run() src/layout/base/nsRefreshDriver.cpp:512:20
#8 0x7fb034c35ff1 in nsThread::ProcessNextEvent(bool, bool*) src/xpcom/threads/nsThread.cpp:1302:14
#9 0x7fb034c401a0 in NS_ProcessNextEvent(nsIThread*, bool) src/xpcom/threads/nsThreadUtils.cpp:393:10
#10 0x7fb03576a235 in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) src/ipc/glue/MessagePump.cpp:96:21
#11 0x7fb0356b71d7 in MessageLoop::RunInternal() src/ipc/chromium/src/base/message_loop.cc:238:10
#12 0x7fb0356b7069 in MessageLoop::Run() src/ipc/chromium/src/base/message_loop.cc:211:3
#13 0x7fb039d1b07a in nsBaseAppShell::Run() src/widget/nsBaseAppShell.cpp:156:27
#14 0x7fb03c8fb471 in nsAppStartup::Run() src/toolkit/components/startup/nsAppStartup.cpp:283:30
#15 0x7fb03ca54a52 in XREMain::XRE_mainRun() src/toolkit/xre/nsAppRunner.cpp:4568:22
#16 0x7fb03ca5668b in XREMain::XRE_main(int, char**, mozilla::BootstrapConfig const&) src/toolkit/xre/nsAppRunner.cpp:4748:8
#17 0x7fb03ca57578 in XRE_main(int, char**, mozilla::BootstrapConfig const&) src/toolkit/xre/nsAppRunner.cpp:4843:21
#18 0x4eca88 in do_main(int, char**, char**) src/browser/app/nsBrowserApp.cpp:236:22
#19 0x4ec3a0 in main src/browser/app/nsBrowserApp.cpp:309:16
#20 0x7fb0516f582f in __libc_start_main /build/glibc-9tT8Do/glibc-2.23/csu/../csu/libc-start.c:291
#21 0x41e0d4 in _start (debug/firefox+0x41e0d4)

Comment 1

[alexander :surkov (:asurkov)]

p3 backlog is probably a way to get the issue lost, while it may be quite serious; marking as depending on bug 1368784 to keep track of it

Comment 2

[Ryan VanderMeulen [:RyanVM]]

INFO: Last good revision: 75fc07efe46f01a41b42b9549ca08ad32c4e78f5
INFO: First bad revision: 916cbaf21a63da2f7953933481a502d7db9b39a0
INFO: Pushlog:
https://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=75fc07efe46f01a41b42b9549ca08ad32c4e78f5&tochange=916cbaf21a63da2f7953933481a502d7db9b39a0

Which isn't a surprising result I guess since that's the bug which added said assert to begin with.

Comment 3

[Firefox Bug Husbandry Bot]

https://wiki.mozilla.org/Bug_Triage/Projects/Bug_Handling/Bug_Husbandry#Move_fix-optionals

Comment 4

[Tyson Smith [:tsmith]]

This issue has been around for a long time and the fuzzers continue to trip over it. This issue is not quite a fuzzblocker[1] but it is pretty close. Jamie can you please find someone to have a look if possible? Thank you.

[1] https://firefox-source-docs.mozilla.org/tools/fuzzing/index.html#fuzz-blockers

Comment 5

[Eitan Isaacson [:eeejay]]

Attachment: Bug 1370669 - Don't queue redundant hide events. r?Jamie!

An accessible can be hidden twice in a mutation event queue. With the first
time representing a move. Instead of queueing a second hide event,
simply drop it.

Comment 6

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/cf05cf3ac8c6
Don't queue redundant hide events. r=Jamie

Comment 7

[Dorel Luca [:dluca]]

https://hg.mozilla.org/mozilla-central/rev/cf05cf3ac8c6

Comment 8

[Ryan VanderMeulen [:RyanVM]]

Can we land a test for this?

Comment 9

[Ryan VanderMeulen [:RyanVM]]

Jamie, maybe you can answer comment 6?

Comment 10

[Eitan Isaacson [:eeejay]]

I tried to get a test for this, but it this isn't easy to reproduce reliably. Kept the ni open hoping to come back and try again. but i'm just going to admit failure.

Comment 11

[James Teh [:Jamie]]

See comment 10.