Closed Bug 1396478 Opened 2 years ago Closed 2 years ago

Assertion failure: container (Text node having rendered text hasn't accessible document!) [@ mozilla::a11y::NotificationController::WillRefresh]

Categories

(Core :: Disability Access APIs, defect, P2)

defect

Tracking

()

RESOLVED FIXED
mozilla59
Tracking Status
firefox-esr52 --- wontfix
firefox56 --- wontfix
firefox57 --- wontfix
firefox58 --- wontfix
firefox59 --- fixed

People

(Reporter: tsmith, Assigned: eeejay)

References

(Blocks 1 open bug)

Details

(Keywords: assertion, testcase)

Attachments

(3 files, 2 obsolete files)

Attached file test_case.html
Assertion failure: container (Text node having rendered text hasn't accessible document!), at src/accessible/base/NotificationController.cpp:717

#0 0x7f53e199ca3f in mozilla::a11y::NotificationController::WillRefresh(mozilla::TimeStamp) src/accessible/base/NotificationController.cpp:886:25
#1 0x7f53df27a1bb in nsRefreshDriver::Tick(long, mozilla::TimeStamp) src/layout/base/nsRefreshDriver.cpp:1886:12
#2 0x7f53df28394e in mozilla::RefreshDriverTimer::TickRefreshDrivers(long, mozilla::TimeStamp, nsTArray<RefPtr<nsRefreshDriver> >&) src/layout/base/nsRefreshDriver.cpp:307:7
#3 0x7f53df283724 in mozilla::RefreshDriverTimer::Tick(long, mozilla::TimeStamp) src/layout/base/nsRefreshDriver.cpp:328:5
#4 0x7f53df286d15 in mozilla::VsyncRefreshDriverTimer::RunRefreshDrivers(mozilla::TimeStamp) src/layout/base/nsRefreshDriver.cpp:770:5
#5 0x7f53df285db6 in mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::TickRefreshDriver(mozilla::TimeStamp) src/layout/base/nsRefreshDriver.cpp:683:35
#6 0x7f53df281d27 in mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::ParentProcessVsyncNotifier::Run() src/layout/base/nsRefreshDriver.cpp:529:20
#7 0x7f53d999d96f in nsThread::ProcessNextEvent(bool, bool*) src/xpcom/threads/nsThread.cpp:1039:14
#8 0x7f53d99a2810 in NS_ProcessNextEvent(nsIThread*, bool) src/xpcom/threads/nsThreadUtils.cpp:521:10
#9 0x7f53da50f025 in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) src/ipc/glue/MessagePump.cpp:97:21
#10 0x7f53da45fae7 in MessageLoop::RunInternal() src/ipc/chromium/src/base/message_loop.cc:326:10
#11 0x7f53da45f979 in MessageLoop::Run() src/ipc/chromium/src/base/message_loop.cc:299:3
#12 0x7f53ded7c6ea in nsBaseAppShell::Run() src/widget/nsBaseAppShell.cpp:158:27
#13 0x7f53e1f65d51 in nsAppStartup::Run() src/toolkit/components/startup/nsAppStartup.cpp:288:30
#14 0x7f53e20c984e in XREMain::XRE_mainRun() src/toolkit/xre/nsAppRunner.cpp:4643:22
#15 0x7f53e20cb4fa in XREMain::XRE_main(int, char**, mozilla::BootstrapConfig const&) src/toolkit/xre/nsAppRunner.cpp:4807:8
#16 0x7f53e20cc3e8 in XRE_main(int, char**, mozilla::BootstrapConfig const&) src/toolkit/xre/nsAppRunner.cpp:4902:21
#17 0x4ecb68 in do_main(int, char**, char**) src/browser/app/nsBrowserApp.cpp:236:22
#18 0x4ec480 in main src/browser/app/nsBrowserApp.cpp:309:16
#19 0x7f53f893e82f in __libc_start_main /build/glibc-bfm8X4/glibc-2.23/csu/../csu/libc-start.c:291
#20 0x41e1b4 in _start (firefox+0x41e1b4)
Flags: in-testsuite?
Still reproduces on trunk. Goes back more than a year (which is as far back as mozregression can bisect debug builds).
Has Regression Range: --- → no
I am hitting this fairly frequently while fuzzing.
David, can we bump the priority on this to help unblock our fuzzers?
Flags: needinfo?(dbolter)
Eitan, do you have cycles to check this one, to figure out what's going on here? It could be related with one of text updates problems we were looking a while ago.
Flags: needinfo?(eitan)
Assignee: nobody → eitan
Flags: needinfo?(eitan)
Flags: needinfo?(dbolter)
Comment on attachment 8935172 [details] [diff] [review]
Don't process text changes from nodes that were removed from doc. r?surkov

Review of attachment 8935172 [details] [diff] [review]:
-----------------------------------------------------------------

nice!

::: accessible/base/NotificationController.cpp
@@ +655,2 @@
>        NS_ASSERTION(!textAcc,
>                     "Text node was removed but accessible is kept alive!");

please replace it on MOZ_ASSERT while you are here.
Attachment #8935172 - Flags: review?(surkov.alexander) → review+
Attachment #8935172 - Attachment is obsolete: true
Pushed by csabou@mozilla.com:
https://hg.mozilla.org/integration/mozilla-inbound/rev/62ebba5a426a
Don't process text changes from nodes that were removed from doc. r=surkov
Keywords: checkin-needed
https://hg.mozilla.org/mozilla-central/rev/62ebba5a426a
Status: NEW → RESOLVED
Closed: 2 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla59
Is this something we should consider uplifting to Beta or can it ride the 59 train? Also, can the attached testcase be landed as a crashtest?
Flags: needinfo?(eitan)
Attached patch Add a crashtest. r?RyanVM (obsolete) — Splinter Review
Attachment #8936614 - Flags: review?(ryanvm)
I don't think we need to uplift this.
Flags: needinfo?(eitan)
Comment on attachment 8936614 [details] [diff] [review]
Add a crashtest. r?RyanVM

Review of attachment 8936614 [details] [diff] [review]:
-----------------------------------------------------------------

Did you forget to hg add the test?
Attachment #8936614 - Flags: review?(ryanvm) → review-
Perhaps I forgot something earlier!
Attachment #8937727 - Flags: review?(ryanvm)
Attachment #8936614 - Attachment is obsolete: true
Attachment #8937727 - Flags: review?(ryanvm) → review+
Flags: needinfo?(ryanvm) → needinfo?(twsmith)
Flags: needinfo?(twsmith) → needinfo?(eitan)
Flags: needinfo?(eitan)
You need to log in before you can comment on or make changes to this bug.