Open Bug 1440950 Opened 2 years ago Updated 7 months ago

Assertion failure: !textAcc (Text node isn't rendered but accessible is kept alive!)

Categories

(Core :: Disability Access APIs, defect)

defect
Not set

Tracking

()

Tracking Status
firefox-esr60 --- affected
firefox-esr68 --- affected
firefox60 --- wontfix
firefox68 --- wontfix
firefox69 --- wontfix
firefox70 --- affected
firefox71 --- affected

People

(Reporter: tsmith, Unassigned)

References

(Blocks 1 open bug)

Details

(Keywords: assertion, testcase, Whiteboard: [tbird crash] a11y:crash-tree)

Attachments

(1 file, 2 obsolete files)

Attached file testcase.html (obsolete) —
Found on mozilla-central
BuildID=20180223194828
SourceStamp=ad3c6f89d67752309a473e57a47fb88f9da37683

Assertion failure: !textAcc (Text node isn't rendered but accessible is kept alive!), at src/accessible/base/NotificationController.cpp:693

#0 mozilla::a11y::NotificationController::WillRefresh(mozilla::TimeStamp) src/accessible/base/NotificationController.cpp:752:7
#1 nsRefreshDriver::Tick(long, mozilla::TimeStamp) src/layout/base/nsRefreshDriver.cpp:1886:12
#2 mozilla::RefreshDriverTimer::TickRefreshDrivers(long, mozilla::TimeStamp, nsTArray<RefPtr<nsRefreshDriver> >&) src/layout/base/nsRefreshDriver.cpp:310:7
#3 mozilla::RefreshDriverTimer::Tick(long, mozilla::TimeStamp) src/layout/base/nsRefreshDriver.cpp:332:5
#4 mozilla::VsyncRefreshDriverTimer::RunRefreshDrivers(mozilla::TimeStamp) src/layout/base/nsRefreshDriver.cpp:773:5
#5 mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::TickRefreshDriver(mozilla::TimeStamp) src/layout/base/nsRefreshDriver.cpp:686:35
#6 mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::NotifyVsync(mozilla::TimeStamp) src/layout/base/nsRefreshDriver.cpp:587:9
#7 mozilla::layout::VsyncChild::RecvNotify(mozilla::TimeStamp const&) src/layout/ipc/VsyncChild.cpp:68:16
#8 mozilla::layout::PVsyncChild::OnMessageReceived(IPC::Message const&) src/obj-firefox/ipc/ipdl/PVsyncChild.cpp:155:20
#9 mozilla::ipc::PBackgroundChild::OnMessageReceived(IPC::Message const&) src/obj-firefox/ipc/ipdl/PBackgroundChild.cpp:1812:28
#10 mozilla::ipc::MessageChannel::DispatchAsyncMessage(IPC::Message const&) src/ipc/glue/MessageChannel.cpp:2110:25
#11 mozilla::ipc::MessageChannel::DispatchMessage(IPC::Message&&) src/ipc/glue/MessageChannel.cpp:2040:17
#12 mozilla::ipc::MessageChannel::RunMessage(mozilla::ipc::MessageChannel::MessageTask&) src/ipc/glue/MessageChannel.cpp:1886:5
#13 mozilla::ipc::MessageChannel::MessageTask::Run() src/ipc/glue/MessageChannel.cpp:1919:15
#14 nsThread::ProcessNextEvent(bool, bool*) src/xpcom/threads/nsThread.cpp:1040:14
#15 NS_ProcessNextEvent(nsIThread*, bool) src/xpcom/threads/nsThreadUtils.cpp:517:10
#16 mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) src/ipc/glue/MessagePump.cpp:97:21
#17 MessageLoop::RunInternal() src/ipc/chromium/src/base/message_loop.cc:326:10
#18 MessageLoop::Run() src/ipc/chromium/src/base/message_loop.cc:299:3
#19 nsBaseAppShell::Run() src/widget/nsBaseAppShell.cpp:157:27
#20 XRE_RunAppShell() src/toolkit/xre/nsEmbedFunctions.cpp:892:22
#21 mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) src/ipc/glue/MessagePump.cpp:269:9
#22 MessageLoop::RunInternal() src/ipc/chromium/src/base/message_loop.cc:326:10
#23 MessageLoop::Run() src/ipc/chromium/src/base/message_loop.cc:299:3
#24 XRE_InitChildProcess(int, char**, XREChildData const*) src/toolkit/xre/nsEmbedFunctions.cpp:718:34
#25 content_process_main(mozilla::Bootstrap*, int, char**) src/browser/app/../../ipc/contentproc/plugin-container.cpp:63:30
#26 main src/browser/app/nsBrowserApp.cpp:280:18
#27 __libc_start_main /build/glibc-Cl5G7W/glibc-2.23/csu/../csu/libc-start.c:291
#28 _start (firefox+0x423444)
Flags: in-testsuite?
Whiteboard: [tbird crash] a11y:crash-tree
Attached file testcase.html (obsolete) —

More reliable test case.

Attachment #8953782 - Attachment is obsolete: true

So the new test case is more reliable because there has been a regression. We can fix that here or in a spinoff. If the original testcase is still reproducible, this is still a bug.

See Also: → 1580292

Filed bug 1580292 that resolves the latest test case. If the original case is still valid, this bug should remain open.

I can retest/see what the fuzzers are hitting once bug 1580292 is fixed.

Flags: needinfo?(twsmith)
Attached file testcase.html

I can reproduce with this test case. It does require layout.css.column-span.enabled=true however that is now the default.

Attachment #9091527 - Attachment is obsolete: true
Flags: needinfo?(twsmith)
You need to log in before you can comment on or make changes to this bug.