1572829 - Assertion failure: !GetAccService() || !GetAccService()->HasAccessible(this) (An accessible for this element still exists!), src/dom/base/Element.cpp:1871

Status: RESOLVED FIXED

(Core :: Disability Access APIs, defect, P1)

Description

[Tyson Smith [:tsmith]]

Attachment: testcase.html

Reduced with m-c:
BuildID=20190809095611
SourceStamp=36c3240e5cafd7b57146bab3b177bfa47f42bcfa

Assertion failure: !GetAccService() || !GetAccService()->HasAccessible(this) (An accessible for this element still exists!), at src/dom/base/Element.cpp:1871

#0 mozilla::dom::Element::UnbindFromTree(bool) src/dom/base/Element.cpp:1991:3
#1 nsGenericHTMLElement::UnbindFromTree(bool) src/dom/html/nsGenericHTMLElement.cpp:461:20
#2 mozilla::dom::HTMLSharedElement::UnbindFromTree(bool) src/dom/html/HTMLSharedElement.cpp:250:25
#3 mozilla::dom::Element::UnbindFromTree(bool) src/dom/base/Element.cpp:1980:12
#4 nsGenericHTMLElement::UnbindFromTree(bool) src/dom/html/nsGenericHTMLElement.cpp:461:20
#5 nsINode::RemoveChildNode(nsIContent*, bool) src/dom/base/nsINode.cpp:1820:9
#6 nsINode::ReplaceOrInsertBefore(bool, nsINode*, nsINode*, mozilla::ErrorResult&) src/dom/base/nsINode.cpp:2307:5
#7 nsINode::ReplaceWith(mozilla::dom::Sequence<mozilla::dom::OwningNodeOrString> const&, mozilla::ErrorResult&) src/dom/base/nsINode.cpp:1666:13
#8 mozilla::dom::Element_Binding::replaceWith(JSContext*, JS::Handle<JSObject*>, mozilla::dom::Element*, JSJitMethodCallArgs const&) src/obj-firefox/dom/bindings/ElementBinding.cpp:5340:24
#9 bool mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::NormalThisPolicy, mozilla::dom::binding_detail::ThrowExceptions>(JSContext*, unsigned int, JS::Value*) src/dom/bindings/BindingUtils.cpp:3163:13
#10 CallJSNative(JSContext*, bool (*)(JSContext*, unsigned int, JS::Value*), JS::CallArgs const&) src/js/src/vm/Interpreter.cpp:447:13
#11 js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) src/js/src/vm/Interpreter.cpp:539:12
#12 InternalCall(JSContext*, js::AnyInvokeArgs const&) src/js/src/vm/Interpreter.cpp:594:10
#13 Interpret(JSContext*, js::RunState&) src/js/src/vm/Interpreter.cpp:3083:16
#14 js::RunScript(JSContext*, js::RunState&) src/js/src/vm/Interpreter.cpp:424:10
#15 js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) src/js/src/vm/Interpreter.cpp:567:13
#16 InternalCall(JSContext*, js::AnyInvokeArgs const&) src/js/src/vm/Interpreter.cpp:594:10
#17 js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>) src/js/src/vm/Interpreter.cpp:610:8
#18 JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>) src/js/src/jsapi.cpp:2659:10
#19 mozilla::dom::EventHandlerNonNull::Call(JSContext*, JS::Handle<JS::Value>, mozilla::dom::Event&, JS::MutableHandle<JS::Value>, mozilla::ErrorResult&) src/obj-firefox/dom/bindings/EventHandlerBinding.cpp:267:37
#20 void mozilla::dom::EventHandlerNonNull::Call<nsCOMPtr<mozilla::dom::EventTarget> >(nsCOMPtr<mozilla::dom::EventTarget> const&, mozilla::dom::Event&, JS::MutableHandle<JS::Value>, mozilla::ErrorResult&, char const*, mozilla::dom::CallbackObject::ExceptionHandling, JS::Realm*) src/obj-firefox/dist/include/mozilla/dom/EventHandlerBinding.h:363:12
#21 mozilla::JSEventHandler::HandleEvent(mozilla::dom::Event*) src/dom/events/JSEventHandler.cpp:205:12
#22 mozilla::EventListenerManager::HandleEventSubType(mozilla::EventListenerManager::Listener*, mozilla::dom::Event*, mozilla::dom::EventTarget*) src/dom/events/EventListenerManager.cpp:1031:22
#23 mozilla::EventListenerManager::HandleEventInternal(nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event**, mozilla::dom::EventTarget*, nsEventStatus*, bool) src/dom/events/EventListenerManager.cpp:1223:17
#24 mozilla::EventTargetChainItem::HandleEvent(mozilla::EventChainPostVisitor&, mozilla::ELMCreationDetector&) src/dom/events/EventDispatcher.cpp:349:17
#25 mozilla::EventTargetChainItem::HandleEventTargetChain(nsTArray<mozilla::EventTargetChainItem>&, mozilla::EventChainPostVisitor&, mozilla::EventDispatchingCallback*, mozilla::ELMCreationDetector&) src/dom/events/EventDispatcher.cpp:551:16
#26 mozilla::EventDispatcher::Dispatch(nsISupports*, nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event*, nsEventStatus*, mozilla::EventDispatchingCallback*, nsTArray<mozilla::dom::EventTarget*>*) src/dom/events/EventDispatcher.cpp:1047:11
#27 nsDocumentViewer::LoadComplete(nsresult) src/layout/base/nsDocumentViewer.cpp:1170:7
#28 nsDocShell::EndPageLoad(nsIWebProgress*, nsIChannel*, nsresult) src/docshell/base/nsDocShell.cpp:6561:20
#29 nsDocShell::OnStateChange(nsIWebProgress*, nsIRequest*, unsigned int, nsresult) src/docshell/base/nsDocShell.cpp:6361:7
#30 non-virtual thunk to nsDocShell::OnStateChange(nsIWebProgress*, nsIRequest*, unsigned int, nsresult) src/docshell/base/nsDocShell.cpp
#31 nsDocLoader::DoFireOnStateChange(nsIWebProgress*, nsIRequest*, int&, nsresult) src/uriloader/base/nsDocLoader.cpp:1333:3
#32 nsDocLoader::doStopDocumentLoad(nsIRequest*, nsresult) src/uriloader/base/nsDocLoader.cpp:892:14
#33 nsDocLoader::DocLoaderIsEmpty(bool) src/uriloader/base/nsDocLoader.cpp:726:9
#34 nsDocLoader::OnStopRequest(nsIRequest*, nsresult) src/uriloader/base/nsDocLoader.cpp:614:5
#35 non-virtual thunk to nsDocLoader::OnStopRequest(nsIRequest*, nsresult) src/uriloader/base/nsDocLoader.cpp
#36 mozilla::net::nsLoadGroup::RemoveRequest(nsIRequest*, nsISupports*, nsresult) src/netwerk/base/nsLoadGroup.cpp:568:22
#37 mozilla::dom::Document::DoUnblockOnload() src/dom/base/Document.cpp:10736:18
#38 mozilla::dom::nsUnblockOnloadEvent::Run() src/dom/base/Document.cpp:10692:11
#39 mozilla::SchedulerGroup::Runnable::Run() src/xpcom/threads/SchedulerGroup.cpp:295:32
#40 nsThread::ProcessNextEvent(bool, bool*) src/xpcom/threads/nsThread.cpp:1225:14
#41 NS_ProcessNextEvent(nsIThread*, bool) src/xpcom/threads/nsThreadUtils.cpp:486:10
#42 mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) src/ipc/glue/MessagePump.cpp:88:21
#43 MessageLoop::RunInternal() src/ipc/chromium/src/base/message_loop.cc:315:10
#44 MessageLoop::Run() src/ipc/chromium/src/base/message_loop.cc:290:3
#45 nsBaseAppShell::Run() src/widget/nsBaseAppShell.cpp:137:27
#46 XRE_RunAppShell() src/toolkit/xre/nsEmbedFunctions.cpp:919:20
#47 mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) src/ipc/glue/MessagePump.cpp:238:9
#48 MessageLoop::RunInternal() src/ipc/chromium/src/base/message_loop.cc:315:10
#49 MessageLoop::Run() src/ipc/chromium/src/base/message_loop.cc:290:3
#50 XRE_InitChildProcess(int, char**, XREChildData const*) src/toolkit/xre/nsEmbedFunctions.cpp:754:34
#51 content_process_main(mozilla::Bootstrap*, int, char**) src/browser/app/../../ipc/contentproc/plugin-container.cpp:56:28
#52 main src/browser/app/nsBrowserApp.cpp:267:18

Comment 1

[Emilio Cobos Álvarez (:emilio)]

Bug 686400 too, more than likely :)

Comment 2

[Emilio Cobos Álvarez (:emilio)]

Eitan, I think this is one of the Shadow DOM cases that I pointed out were probably wrong with the current ContentRemoved implementation :)

Comment 3

[Eitan Isaacson [:eeejay]]

Yup, it looks like this and bug 1572851 are potential shadow dom issues. I already have a few failing tests to work with, just need to file a bug. I hope we can revisit these two bugs once the shadow dom stuff is resolved.

Comment 4

[BugBot [:suhaib / :marco/ :calixte]]

The priority flag is not set for this bug.
:Jamie, could you have a look please?

For more information, please visit auto_nag documentation.

Comment 5

[Eitan Isaacson [:eeejay]]

Attachment: Bug 1572829 - Remove explicit children too when node has a shadow root. r?Jamie!

Comment 6

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/170a5ba09a6f
Remove explicit children too when node has a shadow root. r=Jamie

Comment 7

[Cristina Coroiu [:ccoroiu]]

https://hg.mozilla.org/mozilla-central/rev/170a5ba09a6f