Closed Bug 1578282 Opened 7 months ago Closed 7 months ago

Assertion failure: aIdxInParent <= static_cast<int32_t>(aNewParent->mChildren.Length()) (Wrong insertion point for a moving child), at src/accessible/generic/DocAccessible.cpp:2273

Categories

(Core :: Disability Access APIs, defect, P2)

defect

Tracking

()

RESOLVED FIXED
mozilla71
Tracking Status
firefox-esr60 --- unaffected
firefox-esr68 --- unaffected
firefox69 --- unaffected
firefox70 --- fixed
firefox71 --- fixed

People

(Reporter: tsmith, Assigned: eeejay)

References

(Blocks 1 open bug, Regression)

Details

(4 keywords)

Crash Data

Attachments

(2 files)

Attached file testcase.html

Reduced with m-c:
BuildID=20190902094857
SourceStamp=db860d4b10078af59956a4279d1bb6f299e3935c

Assertion failure: aIdxInParent <= static_cast<int32_t>(aNewParent->mChildren.Length()) (Wrong insertion point for a moving child), at src/accessible/generic/DocAccessible.cpp:2273

0 mozilla::a11y::DocAccessible::MoveChild(mozilla::a11y::Accessible*, mozilla::a11y::Accessible*, int) src/accessible/generic/DocAccessible.cpp:2268:3
1 mozilla::a11y::DocAccessible::ProcessContentInserted(mozilla::a11y::Accessible*, nsTArray<nsCOMPtr<nsIContent> > const*) src/accessible/generic/DocAccessible.cpp:1911:9
2 mozilla::a11y::NotificationController::WillRefresh(mozilla::TimeStamp) src/accessible/base/NotificationController.cpp:743:16
3 nsRefreshDriver::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) src/layout/base/nsRefreshDriver.cpp:1928:12
4 mozilla::RefreshDriverTimer::TickRefreshDrivers(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsTArray<RefPtr<nsRefreshDriver> >&) src/layout/base/nsRefreshDriver.cpp:350:7
5 mozilla::RefreshDriverTimer::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) src/layout/base/nsRefreshDriver.cpp:367:5
6 mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::TickRefreshDriver(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) src/layout/base/nsRefreshDriver.cpp:727:16
7 mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::NotifyVsync(mozilla::VsyncEvent const&) src/layout/base/nsRefreshDriver.cpp:622:9
8 mozilla::layout::VsyncChild::RecvNotify(mozilla::VsyncEvent const&) src/layout/ipc/VsyncChild.cpp:65:16
9 mozilla::layout::PVsyncChild::OnMessageReceived(IPC::Message const&) src/obj-firefox/ipc/ipdl/PVsyncChild.cpp:187:54
10 mozilla::ipc::PBackgroundChild::OnMessageReceived(IPC::Message const&) src/obj-firefox/ipc/ipdl/PBackgroundChild.cpp:5759:32
11 mozilla::ipc::MessageChannel::DispatchAsyncMessage(mozilla::ipc::ActorLifecycleProxy*, IPC::Message const&) src/ipc/glue/MessageChannel.cpp:2183:25
12 mozilla::ipc::MessageChannel::DispatchMessage(IPC::Message&&) src/ipc/glue/MessageChannel.cpp:2107:9
13 mozilla::ipc::MessageChannel::RunMessage(mozilla::ipc::MessageChannel::MessageTask&) src/ipc/glue/MessageChannel.cpp:1954:3
14 mozilla::ipc::MessageChannel::MessageTask::Run() src/ipc/glue/MessageChannel.cpp:1985:13
15 nsThread::ProcessNextEvent(bool, bool*) src/xpcom/threads/nsThread.cpp:1225:14
16 NS_ProcessNextEvent(nsIThread*, bool) src/xpcom/threads/nsThreadUtils.cpp:486:10
17 mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) src/ipc/glue/MessagePump.cpp:88:21
18 MessageLoop::RunInternal() src/ipc/chromium/src/base/message_loop.cc:315:10
19 MessageLoop::Run() src/ipc/chromium/src/base/message_loop.cc:290:3
20 nsBaseAppShell::Run() src/widget/nsBaseAppShell.cpp:137:27
21 XRE_RunAppShell() src/toolkit/xre/nsEmbedFunctions.cpp:934:20
22 mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) src/ipc/glue/MessagePump.cpp:238:9
23 MessageLoop::RunInternal() src/ipc/chromium/src/base/message_loop.cc:315:10
24 MessageLoop::Run() src/ipc/chromium/src/base/message_loop.cc:290:3
25 XRE_InitChildProcess(int, char**, XREChildData const*) src/toolkit/xre/nsEmbedFunctions.cpp:769:34
26 content_process_main(mozilla::Bootstrap*, int, char**) src/browser/app/../../ipc/contentproc/plugin-container.cpp:56:28
27 main src/browser/app/nsBrowserApp.cpp:267:18
Flags: in-testsuite?
Crash Signature: [@ InvalidArrayIndex_CRASH | RemoveElementsAt | mozilla::a11y::HyperTextAccessible::RemoveChild] [@ MOZ_CRASH | InvalidArrayIndex_CRASH | RemoveElementsAt | mozilla::a11y::HyperTextAccessible::RemoveChild]
Priority: -- → P2
Regressed by: 1576690
Has Regression Range: --- → yes
Assignee: nobody → eitan

This assures that a node that has already been inserted in a shadow root
subtree does not get erroneously reinserted into the top container.

Pushed by eisaacson@mozilla.com:
https://hg.mozilla.org/integration/autoland/rev/c7abc15f7444
Use flattened tree parent when getting inserted node container. r=Jamie
Status: NEW → RESOLVED
Closed: 7 months ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla71
See Also: → 1579394
Flags: in-testsuite? → in-testsuite+

Can you request uplift to beta please?

Flags: needinfo?(eitan)

The crash volume on bug 1579394 is so high that I'd like to include this in today's beta build. Jamie, if Eitan isn't around can you do the uplift request? Thanks!

Flags: needinfo?(jteh)

Comment on attachment 9090799 [details]
Bug 1578282 - Use flattened tree parent when getting inserted node container. r?Jamie!

Beta/Release Uplift Approval Request

  • User impact if declined: High crash volume
  • Is this code covered by automated tests?: Yes
  • Has the fix been verified in Nightly?: Yes
  • Needs manual test from QE?: No
  • If yes, steps to reproduce:
  • List of other uplifts needed: None
  • Risk to taking this patch: Low
  • Why is the change risky/not risky? (and alternatives if risky): This is a simple one-liner
  • String changes made/needed:
Flags: needinfo?(eitan)
Attachment #9090799 - Flags: approval-mozilla-beta?

Comment on attachment 9090799 [details]
Bug 1578282 - Use flattened tree parent when getting inserted node container. r?Jamie!

Fix for high volume crash in early beta 70. OK for uplift for beta 5.

Attachment #9090799 - Flags: approval-mozilla-beta? → approval-mozilla-beta+
Flags: needinfo?(jteh)
Duplicate of this bug: 1579394
Crash Signature: [@ InvalidArrayIndex_CRASH | RemoveElementsAt | mozilla::a11y::HyperTextAccessible::RemoveChild] [@ MOZ_CRASH | InvalidArrayIndex_CRASH | RemoveElementsAt | mozilla::a11y::HyperTextAccessible::RemoveChild] → [@ InvalidArrayIndex_CRASH | RemoveElementsAt | mozilla::a11y::HyperTextAccessible::RemoveChild] [@ MOZ_CRASH | InvalidArrayIndex_CRASH | RemoveElementsAt | mozilla::a11y::HyperTextAccessible::RemoveChild] [@ InvalidArrayIndex_CRASH | nsTArray_Impl<T>::R…
You need to log in before you can comment on or make changes to this bug.