1396478 - Assertion failure: container (Text node having rendered text hasn't accessible document!) [@ mozilla::a11y::NotificationController::WillRefresh]

Status: RESOLVED FIXED

Description

[Tyson Smith [:tsmith]]

Created attachment 8904111 [details]
test_case.html

Assertion failure: container (Text node having rendered text hasn't accessible document!), at src/accessible/base/NotificationController.cpp:717

#0 0x7f53e199ca3f in mozilla::a11y::NotificationController::WillRefresh(mozilla::TimeStamp) src/accessible/base/NotificationController.cpp:886:25
#1 0x7f53df27a1bb in nsRefreshDriver::Tick(long, mozilla::TimeStamp) src/layout/base/nsRefreshDriver.cpp:1886:12
#2 0x7f53df28394e in mozilla::RefreshDriverTimer::TickRefreshDrivers(long, mozilla::TimeStamp, nsTArray<RefPtr<nsRefreshDriver> >&) src/layout/base/nsRefreshDriver.cpp:307:7
#3 0x7f53df283724 in mozilla::RefreshDriverTimer::Tick(long, mozilla::TimeStamp) src/layout/base/nsRefreshDriver.cpp:328:5
#4 0x7f53df286d15 in mozilla::VsyncRefreshDriverTimer::RunRefreshDrivers(mozilla::TimeStamp) src/layout/base/nsRefreshDriver.cpp:770:5
#5 0x7f53df285db6 in mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::TickRefreshDriver(mozilla::TimeStamp) src/layout/base/nsRefreshDriver.cpp:683:35
#6 0x7f53df281d27 in mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::ParentProcessVsyncNotifier::Run() src/layout/base/nsRefreshDriver.cpp:529:20
#7 0x7f53d999d96f in nsThread::ProcessNextEvent(bool, bool*) src/xpcom/threads/nsThread.cpp:1039:14
#8 0x7f53d99a2810 in NS_ProcessNextEvent(nsIThread*, bool) src/xpcom/threads/nsThreadUtils.cpp:521:10
#9 0x7f53da50f025 in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) src/ipc/glue/MessagePump.cpp:97:21
#10 0x7f53da45fae7 in MessageLoop::RunInternal() src/ipc/chromium/src/base/message_loop.cc:326:10
#11 0x7f53da45f979 in MessageLoop::Run() src/ipc/chromium/src/base/message_loop.cc:299:3
#12 0x7f53ded7c6ea in nsBaseAppShell::Run() src/widget/nsBaseAppShell.cpp:158:27
#13 0x7f53e1f65d51 in nsAppStartup::Run() src/toolkit/components/startup/nsAppStartup.cpp:288:30
#14 0x7f53e20c984e in XREMain::XRE_mainRun() src/toolkit/xre/nsAppRunner.cpp:4643:22
#15 0x7f53e20cb4fa in XREMain::XRE_main(int, char**, mozilla::BootstrapConfig const&) src/toolkit/xre/nsAppRunner.cpp:4807:8
#16 0x7f53e20cc3e8 in XRE_main(int, char**, mozilla::BootstrapConfig const&) src/toolkit/xre/nsAppRunner.cpp:4902:21
#17 0x4ecb68 in do_main(int, char**, char**) src/browser/app/nsBrowserApp.cpp:236:22
#18 0x4ec480 in main src/browser/app/nsBrowserApp.cpp:309:16
#19 0x7f53f893e82f in __libc_start_main /build/glibc-bfm8X4/glibc-2.23/csu/../csu/libc-start.c:291
#20 0x41e1b4 in _start (firefox+0x41e1b4)

Comment 1

[Ryan VanderMeulen [:RyanVM]]

Still reproduces on trunk. Goes back more than a year (which is as far back as mozregression can bisect debug builds).

Comment 2

[Tyson Smith [:tsmith]]

I am hitting this fairly frequently while fuzzing.

Comment 3

[Ryan VanderMeulen [:RyanVM]]

David, can we bump the priority on this to help unblock our fuzzers?

Comment 4

[alexander :surkov]

Eitan, do you have cycles to check this one, to figure out what's going on here? It could be related with one of text updates problems we were looking a while ago.

Comment 5

[Eitan Isaacson [:eeejay]]

Created attachment 8935172 [details] [diff] [review]
Don't process text changes from nodes that were removed from doc. r?surkov

Comment 6

[alexander :surkov]

Comment on attachment 8935172 [details] [diff] [review]
Don't process text changes from nodes that were removed from doc. r?surkov

Review of attachment 8935172 [details] [diff] [review]:
-----------------------------------------------------------------

nice!

::: accessible/base/NotificationController.cpp
@@ +655,2 @@
>        NS_ASSERTION(!textAcc,
>                     "Text node was removed but accessible is kept alive!");

please replace it on MOZ_ASSERT while you are here.

Comment 7

[Eitan Isaacson [:eeejay]]

Created attachment 8935466 [details] [diff] [review]
Don't process text changes from nodes that were removed from doc.

Comment 8

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/62ebba5a426a
Don't process text changes from nodes that were removed from doc. r=surkov

Comment 9

[Raul Gurzau (:RaulGurzau)]

https://hg.mozilla.org/mozilla-central/rev/62ebba5a426a

Comment 10

[Ryan VanderMeulen [:RyanVM]]

Is this something we should consider uplifting to Beta or can it ride the 59 train? Also, can the attached testcase be landed as a crashtest?

Comment 11

[Eitan Isaacson [:eeejay]]

Created attachment 8936614 [details] [diff] [review]
Add a crashtest. r?RyanVM

Comment 12

[Eitan Isaacson [:eeejay]]

I don't think we need to uplift this.

Comment 13

[Ryan VanderMeulen [:RyanVM]]

Comment on attachment 8936614 [details] [diff] [review]
Add a crashtest. r?RyanVM

Review of attachment 8936614 [details] [diff] [review]:
-----------------------------------------------------------------

Did you forget to hg add the test?

Comment 14

[Eitan Isaacson [:eeejay]]

Created attachment 8937727 [details] [diff] [review]
Add a crashtest. r?RyanVM

Perhaps I forgot something earlier!

Comment 15

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/47637ccbabfd
Add a crashtest. r=RyanVM

Comment 16

[Dorel Luca [:dluca]]

Backed out changeset 47637ccbabfd (bug 1396478) for leaks on a newly-added accessability test on a CLOSED TREE

https://treeherder.mozilla.org/logviewer.html#?job_id=152997513&repo=mozilla-inbound&lineNumber=63618

https://hg.mozilla.org/integration/mozilla-inbound/rev/ea133532d0535f40717f177e9eef93b1ed39c77e

https://treeherder.mozilla.org/#/jobs?repo=mozilla-inbound&revision=47637ccbabfd7ded68c061e4bd2eb624e396c2de