1405020 - Assertion in mozilla::SchedulerGroup::ValidateAccess when mozilla::a11y::ia2AccessibleHypertext::get_nSelections is called

Status: RESOLVED WONTFIX

(Core :: Disability Access APIs, defect, P1)

Description

[(No longer employed by Mozilla) Aaron Klotz]

00 xul!mozilla::SchedulerGroup::ValidateAccess+0x2e
01 xul!mozilla::dom::DocGroup::ValidateAccess+0x19
02 xul!nsDocument::BeginUpdate+0x72
03 xul!mozAutoDocUpdate::mozAutoDocUpdate+0x66
04 xul!nsINode::doRemoveChildAt+0xdd
05 xul!mozilla::dom::FragmentOrElement::RemoveChildAt+0xa0
06 xul!nsTextControlFrame::UpdateValueDisplay+0x3b9
07 xul!nsTextEditorState::PrepareEditor+0x1f9
08 xul!nsTextEditorState::GetTextEditor+0x29
09 xul!mozilla::dom::HTMLInputElement::GetTextEditorFromState+0x22
0a xul!mozilla::dom::HTMLInputElement::GetTextEditor+0x11
0b xul!mozilla::a11y::HTMLTextFieldAccessible::GetEditor+0x6b
0c xul!mozilla::a11y::HyperTextAccessible::GetSelectionDOMRanges+0xa7
0d xul!mozilla::a11y::HyperTextAccessible::SelectionCount+0x1f
0e xul!mozilla::a11y::ia2AccessibleText::get_nSelections+0x93
0f xul!mozilla::a11y::ia2AccessibleHypertext::get_nSelections+0x10
10 ole32!CallFrame::Invoke+0x63
11 xul!`anonymous namespace'::HandoffRunnable::Run+0x88
12 xul!`anonymous namespace'::SyncRunnable::Run+0x36
13 xul!mozilla::SchedulerGroup::Runnable::Run+0x79
14 xul!nsThread::ProcessNextEvent+0x6bd
15 xul!NS_ProcessNextEvent+0x62
16 xul!mozilla::ipc::MessagePump::Run+0x21b
17 xul!mozilla::ipc::MessagePumpForChildProcess::Run+0x17d
18 xul!MessageLoop::RunInternal+0x4d
19 xul!MessageLoop::RunHandler+0x82
1a xul!MessageLoop::Run+0x1d
1b xul!nsBaseAppShell::Run+0x50
1c xul!nsAppShell::Run+0x23
1d xul!XRE_RunAppShell+0x7d
1e xul!mozilla::ipc::MessagePumpForChildProcess::Run+0x6a
1f xul!MessageLoop::RunInternal+0x4d
20 xul!MessageLoop::RunHandler+0x82
21 xul!MessageLoop::Run+0x1d
22 xul!XRE_InitChildProcess+0x9f6
23 xul!mozilla::BootstrapImpl::XRE_InitChildProcess+0x18
24 firefox!content_process_main+0xa4
25 firefox!NS_internal_main+0xd8
26 firefox!wmain+0x138
27 firefox!invoke_main+0x1d
28 firefox!__scrt_common_main_seh+0xf9
29 KERNEL32!BaseThreadInitThunk+0x24
2a ntdll!__RtlUserThreadStart+0x2f
2b ntdll!_RtlUserThreadStart+0x1b

The problem is that MainThreadInvoker is always using the system group, but since this call stack is touching the DOM, we can't do that here.

This does not block our rollout but it does block Quantum DOM, so I think we need to consider this high-priority.

Comment 1

[(No longer employed by Mozilla) Aaron Klotz]

The SystemGroup was added in bug 1390076.

Comment 2

[David Bolter [:davidb] (NeedInfo me for attention)]

Jim will find our quantum-dom schedule.

Comment 3

[Jim Mathies [:jimm]]

scheduling isn't shipping in 57, might be in 58.

Comment 4

[David Bolter [:davidb] (NeedInfo me for attention)]

Does this still block QD?

Comment 5

[David Bolter [:davidb] (NeedInfo me for attention)]

Note QD blocked meta bug is P5... should we lower priority here?

Comment 6

[Andrew Overholt [:overholt]]

I *think* Bill told me there are still issues with a11y and his preemptive scheduler work but I'll defer to him.

Comment 7

[Andrew Overholt [:overholt]]

Are we still seeing these crashes? Comment 6 is moot now.

Comment 8

[(No longer employed by Mozilla) Aaron Klotz]

Only when preemptive scheduling is turned on, which from what billm was telling me in Austin, is not happening.