Assertion failure: container (Text node having rendered text hasn't accessible document!) [@ mozilla::a11y::NotificationController::WillRefresh]

RESOLVED FIXED in Firefox 59

Status

()

Core
Disability Access APIs
P2
normal
RESOLVED FIXED
10 months ago
3 months ago

People

(Reporter: tsmith, Assigned: eeejay, NeedInfo)

Tracking

(Blocks: 1 bug, {assertion, testcase})

Trunk
mozilla59
assertion, testcase
Points:
---
Bug Flags:
in-testsuite ?

Firefox Tracking Flags

(firefox-esr52 wontfix, firefox56 wontfix, firefox57 wontfix, firefox58 wontfix, firefox59 fixed)

Details

Attachments

(3 attachments, 2 obsolete attachments)

(Reporter)

Description

10 months ago
Created attachment 8904111 [details]
test_case.html

Assertion failure: container (Text node having rendered text hasn't accessible document!), at src/accessible/base/NotificationController.cpp:717

#0 0x7f53e199ca3f in mozilla::a11y::NotificationController::WillRefresh(mozilla::TimeStamp) src/accessible/base/NotificationController.cpp:886:25
#1 0x7f53df27a1bb in nsRefreshDriver::Tick(long, mozilla::TimeStamp) src/layout/base/nsRefreshDriver.cpp:1886:12
#2 0x7f53df28394e in mozilla::RefreshDriverTimer::TickRefreshDrivers(long, mozilla::TimeStamp, nsTArray<RefPtr<nsRefreshDriver> >&) src/layout/base/nsRefreshDriver.cpp:307:7
#3 0x7f53df283724 in mozilla::RefreshDriverTimer::Tick(long, mozilla::TimeStamp) src/layout/base/nsRefreshDriver.cpp:328:5
#4 0x7f53df286d15 in mozilla::VsyncRefreshDriverTimer::RunRefreshDrivers(mozilla::TimeStamp) src/layout/base/nsRefreshDriver.cpp:770:5
#5 0x7f53df285db6 in mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::TickRefreshDriver(mozilla::TimeStamp) src/layout/base/nsRefreshDriver.cpp:683:35
#6 0x7f53df281d27 in mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::ParentProcessVsyncNotifier::Run() src/layout/base/nsRefreshDriver.cpp:529:20
#7 0x7f53d999d96f in nsThread::ProcessNextEvent(bool, bool*) src/xpcom/threads/nsThread.cpp:1039:14
#8 0x7f53d99a2810 in NS_ProcessNextEvent(nsIThread*, bool) src/xpcom/threads/nsThreadUtils.cpp:521:10
#9 0x7f53da50f025 in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) src/ipc/glue/MessagePump.cpp:97:21
#10 0x7f53da45fae7 in MessageLoop::RunInternal() src/ipc/chromium/src/base/message_loop.cc:326:10
#11 0x7f53da45f979 in MessageLoop::Run() src/ipc/chromium/src/base/message_loop.cc:299:3
#12 0x7f53ded7c6ea in nsBaseAppShell::Run() src/widget/nsBaseAppShell.cpp:158:27
#13 0x7f53e1f65d51 in nsAppStartup::Run() src/toolkit/components/startup/nsAppStartup.cpp:288:30
#14 0x7f53e20c984e in XREMain::XRE_mainRun() src/toolkit/xre/nsAppRunner.cpp:4643:22
#15 0x7f53e20cb4fa in XREMain::XRE_main(int, char**, mozilla::BootstrapConfig const&) src/toolkit/xre/nsAppRunner.cpp:4807:8
#16 0x7f53e20cc3e8 in XRE_main(int, char**, mozilla::BootstrapConfig const&) src/toolkit/xre/nsAppRunner.cpp:4902:21
#17 0x4ecb68 in do_main(int, char**, char**) src/browser/app/nsBrowserApp.cpp:236:22
#18 0x4ec480 in main src/browser/app/nsBrowserApp.cpp:309:16
#19 0x7f53f893e82f in __libc_start_main /build/glibc-bfm8X4/glibc-2.23/csu/../csu/libc-start.c:291
#20 0x41e1b4 in _start (firefox+0x41e1b4)
Flags: in-testsuite?
Priority: -- → P2
Still reproduces on trunk. Goes back more than a year (which is as far back as mozregression can bisect debug builds).
Has Regression Range: --- → no
status-firefox56: --- → wontfix
status-firefox57: affected → wontfix
status-firefox58: --- → fix-optional
status-firefox-esr52: --- → wontfix
(Reporter)

Comment 2

7 months ago
I am hitting this fairly frequently while fuzzing.
status-firefox59: --- → affected
David, can we bump the priority on this to help unblock our fuzzers?
Flags: needinfo?(dbolter)

Comment 4

7 months ago
Eitan, do you have cycles to check this one, to figure out what's going on here? It could be related with one of text updates problems we were looking a while ago.
Flags: needinfo?(eitan)
(Assignee)

Updated

7 months ago
Assignee: nobody → eitan
Flags: needinfo?(eitan)
(Assignee)

Comment 5

7 months ago
Created attachment 8935172 [details] [diff] [review]
Don't process text changes from nodes that were removed from doc. r?surkov
Attachment #8935172 - Flags: review?(surkov.alexander)
Flags: needinfo?(dbolter)

Comment 6

7 months ago
Comment on attachment 8935172 [details] [diff] [review]
Don't process text changes from nodes that were removed from doc. r?surkov

Review of attachment 8935172 [details] [diff] [review]:
-----------------------------------------------------------------

nice!

::: accessible/base/NotificationController.cpp
@@ +655,2 @@
>        NS_ASSERTION(!textAcc,
>                     "Text node was removed but accessible is kept alive!");

please replace it on MOZ_ASSERT while you are here.
Attachment #8935172 - Flags: review?(surkov.alexander) → review+
(Assignee)

Comment 7

7 months ago
Created attachment 8935466 [details] [diff] [review]
Don't process text changes from nodes that were removed from doc.
(Assignee)

Updated

7 months ago
Attachment #8935172 - Attachment is obsolete: true
(Assignee)

Updated

7 months ago
Keywords: checkin-needed

Comment 8

7 months ago
Pushed by csabou@mozilla.com:
https://hg.mozilla.org/integration/mozilla-inbound/rev/62ebba5a426a
Don't process text changes from nodes that were removed from doc. r=surkov
Keywords: checkin-needed

Comment 9

7 months ago
bugherder
https://hg.mozilla.org/mozilla-central/rev/62ebba5a426a
Status: NEW → RESOLVED
Last Resolved: 7 months ago
status-firefox59: affected → fixed
Resolution: --- → FIXED
Target Milestone: --- → mozilla59
Is this something we should consider uplifting to Beta or can it ride the 59 train? Also, can the attached testcase be landed as a crashtest?
Flags: needinfo?(eitan)
(Assignee)

Comment 11

6 months ago
Created attachment 8936614 [details] [diff] [review]
Add a crashtest. r?RyanVM
Attachment #8936614 - Flags: review?(ryanvm)
(Assignee)

Comment 12

6 months ago
I don't think we need to uplift this.
Flags: needinfo?(eitan)
Comment on attachment 8936614 [details] [diff] [review]
Add a crashtest. r?RyanVM

Review of attachment 8936614 [details] [diff] [review]:
-----------------------------------------------------------------

Did you forget to hg add the test?
Attachment #8936614 - Flags: review?(ryanvm) → review-
(Assignee)

Comment 14

6 months ago
Created attachment 8937727 [details] [diff] [review]
Add a crashtest. r?RyanVM

Perhaps I forgot something earlier!
Attachment #8937727 - Flags: review?(ryanvm)
(Assignee)

Updated

6 months ago
Attachment #8936614 - Attachment is obsolete: true
Attachment #8937727 - Flags: review?(ryanvm) → review+
(Assignee)

Updated

6 months ago
Keywords: checkin-needed

Comment 15

6 months ago
Pushed by ryanvm@gmail.com:
https://hg.mozilla.org/integration/mozilla-inbound/rev/47637ccbabfd
Add a crashtest. r=RyanVM
Keywords: checkin-needed

Updated

6 months ago
Flags: needinfo?(ryanvm) → needinfo?(twsmith)

Updated

6 months ago
Flags: needinfo?(twsmith) → needinfo?(eitan)
status-firefox58: fix-optional → wontfix
You need to log in before you can comment on or make changes to this bug.