1578282 - Assertion failure: aIdxInParent <= static_cast<int32_t>(aNewParent->mChildren.Length()) (Wrong insertion point for a moving child), at src/accessible/generic/DocAccessible.cpp:2273

Status: RESOLVED FIXED

(Core :: Disability Access APIs, defect, P2)

Description

[Tyson Smith [:tsmith]]

Attachment: testcase.html

Reduced with m-c:
BuildID=20190902094857
SourceStamp=db860d4b10078af59956a4279d1bb6f299e3935c

Assertion failure: aIdxInParent <= static_cast<int32_t>(aNewParent->mChildren.Length()) (Wrong insertion point for a moving child), at src/accessible/generic/DocAccessible.cpp:2273

0 mozilla::a11y::DocAccessible::MoveChild(mozilla::a11y::Accessible*, mozilla::a11y::Accessible*, int) src/accessible/generic/DocAccessible.cpp:2268:3
1 mozilla::a11y::DocAccessible::ProcessContentInserted(mozilla::a11y::Accessible*, nsTArray<nsCOMPtr<nsIContent> > const*) src/accessible/generic/DocAccessible.cpp:1911:9
2 mozilla::a11y::NotificationController::WillRefresh(mozilla::TimeStamp) src/accessible/base/NotificationController.cpp:743:16
3 nsRefreshDriver::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) src/layout/base/nsRefreshDriver.cpp:1928:12
4 mozilla::RefreshDriverTimer::TickRefreshDrivers(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsTArray<RefPtr<nsRefreshDriver> >&) src/layout/base/nsRefreshDriver.cpp:350:7
5 mozilla::RefreshDriverTimer::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) src/layout/base/nsRefreshDriver.cpp:367:5
6 mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::TickRefreshDriver(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) src/layout/base/nsRefreshDriver.cpp:727:16
7 mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::NotifyVsync(mozilla::VsyncEvent const&) src/layout/base/nsRefreshDriver.cpp:622:9
8 mozilla::layout::VsyncChild::RecvNotify(mozilla::VsyncEvent const&) src/layout/ipc/VsyncChild.cpp:65:16
9 mozilla::layout::PVsyncChild::OnMessageReceived(IPC::Message const&) src/obj-firefox/ipc/ipdl/PVsyncChild.cpp:187:54
10 mozilla::ipc::PBackgroundChild::OnMessageReceived(IPC::Message const&) src/obj-firefox/ipc/ipdl/PBackgroundChild.cpp:5759:32
11 mozilla::ipc::MessageChannel::DispatchAsyncMessage(mozilla::ipc::ActorLifecycleProxy*, IPC::Message const&) src/ipc/glue/MessageChannel.cpp:2183:25
12 mozilla::ipc::MessageChannel::DispatchMessage(IPC::Message&&) src/ipc/glue/MessageChannel.cpp:2107:9
13 mozilla::ipc::MessageChannel::RunMessage(mozilla::ipc::MessageChannel::MessageTask&) src/ipc/glue/MessageChannel.cpp:1954:3
14 mozilla::ipc::MessageChannel::MessageTask::Run() src/ipc/glue/MessageChannel.cpp:1985:13
15 nsThread::ProcessNextEvent(bool, bool*) src/xpcom/threads/nsThread.cpp:1225:14
16 NS_ProcessNextEvent(nsIThread*, bool) src/xpcom/threads/nsThreadUtils.cpp:486:10
17 mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) src/ipc/glue/MessagePump.cpp:88:21
18 MessageLoop::RunInternal() src/ipc/chromium/src/base/message_loop.cc:315:10
19 MessageLoop::Run() src/ipc/chromium/src/base/message_loop.cc:290:3
20 nsBaseAppShell::Run() src/widget/nsBaseAppShell.cpp:137:27
21 XRE_RunAppShell() src/toolkit/xre/nsEmbedFunctions.cpp:934:20
22 mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) src/ipc/glue/MessagePump.cpp:238:9
23 MessageLoop::RunInternal() src/ipc/chromium/src/base/message_loop.cc:315:10
24 MessageLoop::Run() src/ipc/chromium/src/base/message_loop.cc:290:3
25 XRE_InitChildProcess(int, char**, XREChildData const*) src/toolkit/xre/nsEmbedFunctions.cpp:769:34
26 content_process_main(mozilla::Bootstrap*, int, char**) src/browser/app/../../ipc/contentproc/plugin-container.cpp:56:28
27 main src/browser/app/nsBrowserApp.cpp:267:18

Comment 1

[Eitan Isaacson [:eeejay]]

Attachment: Bug 1578282 - Use flattened tree parent when getting inserted node container. r?Jamie!

This assures that a node that has already been inserted in a shadow root
subtree does not get erroneously reinserted into the top container.

Comment 2

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/c7abc15f7444
Use flattened tree parent when getting inserted node container. r=Jamie

Comment 3

[Natalia Csoregi [:nataliaCs]]

https://hg.mozilla.org/mozilla-central/rev/c7abc15f7444

Comment 4

[Liz Henry (:lizzard) (relman/hg->git project)]

Can you request uplift to beta please?

Comment 5

[Liz Henry (:lizzard) (relman/hg->git project)]

The crash volume on bug 1579394 is so high that I'd like to include this in today's beta build. Jamie, if Eitan isn't around can you do the uplift request? Thanks!

Comment 6

[Eitan Isaacson [:eeejay]]

Comment on attachment 9090799 [details]
Bug 1578282 - Use flattened tree parent when getting inserted node container. r?Jamie!

Beta/Release Uplift Approval Request

• User impact if declined: High crash volume
• Is this code covered by automated tests?: Yes
• Has the fix been verified in Nightly?: Yes
• Needs manual test from QE?: No
• If yes, steps to reproduce:
• List of other uplifts needed: None
• Risk to taking this patch: Low
• Why is the change risky/not risky? (and alternatives if risky): This is a simple one-liner
• String changes made/needed:

Comment 7

[Liz Henry (:lizzard) (relman/hg->git project)]

Comment on attachment 9090799 [details]
Bug 1578282 - Use flattened tree parent when getting inserted node container. r?Jamie!

Fix for high volume crash in early beta 70. OK for uplift for beta 5.

Comment 8

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

https://hg.mozilla.org/releases/mozilla-beta/rev/1021b3e283c6