Closed Bug 1376214 Opened 3 years ago Closed 3 years ago

Assertion failure: static_cast<uint32_t>(aChild->mIndexInParent) != aNewIndex [@ mozilla::a11y::Accessible::MoveChild]

Categories

(Core :: Disability Access APIs, defect)

defect
Not set

Tracking

()

RESOLVED FIXED
mozilla56
Tracking Status
firefox-esr52 --- wontfix
firefox54 --- wontfix
firefox55 --- fixed
firefox56 --- fixed

People

(Reporter: tsmith, Assigned: eeejay)

References

(Blocks 1 open bug)

Details

(Keywords: assertion, crash, testcase)

Attachments

(2 files, 2 obsolete files)

Attached file test_case.html
Assertion failure: static_cast<uint32_t>(aChild->mIndexInParent) != aNewIndex (No move, same index), at src/accessible/generic/Accessible.cpp:2185

#0 0x7f5d8e8ce836 in mozilla::a11y::Accessible::MoveChild(unsigned int, mozilla::a11y::Accessible*) src/accessible/generic/Accessible.cpp:2183:3
#1 0x7f5d8e8ec6ff in mozilla::a11y::DocAccessible::MoveChild(mozilla::a11y::Accessible*, mozilla::a11y::Accessible*, int) src/accessible/generic/DocAccessible.cpp:2219:16
#2 0x7f5d8e8ecc70 in mozilla::a11y::DocAccessible::PutChildrenBack(nsTArray<RefPtr<mozilla::a11y::Accessible> >*, unsigned int) src/accessible/generic/DocAccessible.cpp:2184:5
#3 0x7f5d8e8ebbad in mozilla::a11y::DocAccessible::DoARIAOwnsRelocation(mozilla::a11y::Accessible*) src/accessible/generic/DocAccessible.cpp:2136:3
#4 0x7f5d8e85c75c in mozilla::a11y::NotificationController::WillRefresh(mozilla::TimeStamp) src/accessible/base/NotificationController.cpp:811:18
#5 0x7f5d8b691625 in nsRefreshDriver::Tick(long, mozilla::TimeStamp) src/layout/base/nsRefreshDriver.cpp:1827:12
#6 0x7f5d8b6a0a75 in mozilla::RefreshDriverTimer::TickRefreshDrivers(long, mozilla::TimeStamp, nsTArray<RefPtr<nsRefreshDriver> >&) src/layout/base/nsRefreshDriver.cpp:297:7
#7 0x7f5d8b6a0732 in mozilla::RefreshDriverTimer::Tick(long, mozilla::TimeStamp) src/layout/base/nsRefreshDriver.cpp:318:5
#8 0x7f5d8b6a2e5b in RunRefreshDrivers src/layout/base/nsRefreshDriver.cpp:750:5
#9 0x7f5d8b6a2e5b in mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::TickRefreshDriver(mozilla::TimeStamp) src/layout/base/nsRefreshDriver.cpp:663
#10 0x7f5d8b69e137 in mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::ParentProcessVsyncNotifier::Run() src/layout/base/nsRefreshDriver.cpp:509:20
#11 0x7f5d84cc0e08 in nsThread::ProcessNextEvent(bool, bool*) src/xpcom/threads/nsThread.cpp:1421:14
#12 0x7f5d84cc6f58 in NS_ProcessNextEvent(nsIThread*, bool) src/xpcom/threads/nsThreadUtils.cpp:471:10
#13 0x7f5d85a85ec1 in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) src/ipc/glue/MessagePump.cpp:96:21
#14 0x7f5d859e2850 in RunInternal src/ipc/chromium/src/base/message_loop.cc:320:10
#15 0x7f5d859e2850 in RunHandler src/ipc/chromium/src/base/message_loop.cc:313
#16 0x7f5d859e2850 in MessageLoop::Run() src/ipc/chromium/src/base/message_loop.cc:293
#17 0x7f5d8b001ecf in nsBaseAppShell::Run() src/widget/nsBaseAppShell.cpp:156:27
#18 0x7f5d8f0596a1 in nsAppStartup::Run() src/toolkit/components/startup/nsAppStartup.cpp:283:30
#19 0x7f5d8f227674 in XREMain::XRE_mainRun() src/toolkit/xre/nsAppRunner.cpp:4590:22
#20 0x7f5d8f2291e0 in XREMain::XRE_main(int, char**, mozilla::BootstrapConfig const&) src/toolkit/xre/nsAppRunner.cpp:4774:8
#21 0x7f5d8f22a531 in XRE_main(int, char**, mozilla::BootstrapConfig const&) src/toolkit/xre/nsAppRunner.cpp:4869:21
#22 0x4eb613 in do_main src/browser/app/nsBrowserApp.cpp:237:22
#23 0x4eb613 in main src/browser/app/nsBrowserApp.cpp:310
#24 0x7f5da196b82f in __libc_start_main /build/glibc-bfm8X4/glibc-2.23/csu/../csu/libc-start.c:291
#25 0x41d168 in _start (m-c-1498253338-asan-opt/firefox+0x41d168)
Flags: in-testsuite?
Assignee: nobody → eitan
Attachment #8884451 - Flags: review?(surkov.alexander)
Duplicate of this bug: 1378257
Comment on attachment 8884451 [details] [diff] [review]
Check if we are re-aria-owning a child into its current index. r?surkov

Review of attachment 8884451 [details] [diff] [review]:
-----------------------------------------------------------------

::: accessible/generic/DocAccessible.cpp
@@ -2108,5 @@
>  
>      // Same child on same position, no change.
> -    if (child->Parent() == aOwner &&
> -        child->IndexInParent() == static_cast<int32_t>(insertIdx)) {
> -      MOZ_ASSERT(owned->ElementAt(idx) == child, "Not in sync!");

is there a short example where it happens or some explanation of this?

The patch (IsRelocated() condition specifically) makes me think that IndexInParent == insertIdx for ordinal (not relocated) child, which should be sort of impossible, since insertIdx points after all ordinal children.

@@ +2111,5 @@
> +      int32_t indexInParent = child->IndexInParent();
> +      // Either the child is being placed in its current index, or directly
> +      // after its current index, which is a no-op.
> +      if (indexInParent == static_cast<int32_t>(insertIdx) ||
> +          indexInParent == static_cast<int32_t>(insertIdx) - 1) {

also I don't follow the second clause; the first one is designed to skip unchanged bits of aria-owns, for example, when aria-owns='id1 id2 id3' is changed to aria-owns='id3 id2 id1', and id2 is no change case.
Comment on attachment 8884451 [details] [diff] [review]
Check if we are re-aria-owning a child into its current index. r?surkov

Please disregard this patch. It doesn't fix this issue.
Attachment #8884451 - Attachment is obsolete: true
Attachment #8884451 - Flags: review?(surkov.alexander)
Here is a simplified case that hits this issue.

The child is initially loaded as "relocated" into its own parent. When aria-owns attribute is removed, it gets inserted into the same place.
Attachment #8887585 - Flags: review?(surkov.alexander)
Comment on attachment 8887585 [details] [diff] [review]
Create redundant aria-owned children as not relocated. r?surkov

This may be wrong, holding off.
Attachment #8887585 - Flags: review?(surkov.alexander)
The patch in bug 1378257 will fix this too.
Attachment #8887585 - Attachment is obsolete: true
See Also: → 1378257
A fix should be in tomorrow's nightly. Tyson, can you confirm the fix and close this?
Flags: needinfo?(twsmith)
bug 1378257 adds tests
Depends on: 1378257
Flags: in-testsuite? → in-testsuite+
See Also: 1378257
I can no longer reproduce this issue on m-c.
Changeset: 16ffc1d05422a81099ce8b9b59de66dde4c8b2f0
Build ID: 20170728132457
Flags: needinfo?(twsmith)
Status: NEW → RESOLVED
Closed: 3 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla56
You need to log in before you can comment on or make changes to this bug.