Closed Bug 1581589 Opened 3 months ago Closed 3 months ago

Assertion failure: aIdxInParent <= static_cast<int32_t>(aNewParent->mChildren.Length()) (Wrong insertion point for a moving child), at src/accessible/generic/DocAccessible.cpp:2293

Categories

(Core :: Disability Access APIs, defect, P2)

defect

Tracking

()

RESOLVED FIXED
mozilla71
Tracking Status
firefox-esr60 --- unaffected
firefox-esr68 --- unaffected
firefox69 --- unaffected
firefox70 --- fixed
firefox71 --- fixed

People

(Reporter: tsmith, Assigned: eeejay)

References

(Blocks 1 open bug, Regression)

Details

(Keywords: assertion, regression, testcase)

Attachments

(3 files)

Attached file testcase.html

Reduced with m-c:
BuildID=20190916155843
SourceStamp=d09edbe2abfec5298b39ab5b30d45bf20b8bbe33

Assertion failure: aIdxInParent <= static_cast<int32_t>(aNewParent->mChildren.Length()) (Wrong insertion point for a moving child), at src/accessible/generic/DocAccessible.cpp:2293

#0 mozilla::a11y::DocAccessible::MoveChild(mozilla::a11y::Accessible*, mozilla::a11y::Accessible*, int) src/accessible/generic/DocAccessible.cpp:2288:3
#1 mozilla::a11y::DocAccessible::ProcessContentInserted(mozilla::a11y::Accessible*, nsTArray<nsCOMPtr<nsIContent> > const*) src/accessible/generic/DocAccessible.cpp:1931:9
#2 mozilla::a11y::NotificationController::WillRefresh(mozilla::TimeStamp) src/accessible/base/NotificationController.cpp:743:16
#3 nsRefreshDriver::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) src/layout/base/nsRefreshDriver.cpp:1928:12
#4 mozilla::RefreshDriverTimer::TickRefreshDrivers(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsTArray<RefPtr<nsRefreshDriver> >&) src/layout/base/nsRefreshDriver.cpp:350:7
#5 mozilla::RefreshDriverTimer::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) src/layout/base/nsRefreshDriver.cpp:367:5
#6 mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::TickRefreshDriver(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) src/layout/base/nsRefreshDriver.cpp:727:16
#7 mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::NotifyVsync(mozilla::VsyncEvent const&) src/layout/base/nsRefreshDriver.cpp:622:9
#8 mozilla::layout::VsyncChild::RecvNotify(mozilla::VsyncEvent const&) src/layout/ipc/VsyncChild.cpp:65:16
#9 mozilla::layout::PVsyncChild::OnMessageReceived(IPC::Message const&) src/obj-firefox/ipc/ipdl/PVsyncChild.cpp:187:54
#10 mozilla::ipc::PBackgroundChild::OnMessageReceived(IPC::Message const&) src/obj-firefox/ipc/ipdl/PBackgroundChild.cpp:5759:32
#11 mozilla::ipc::MessageChannel::DispatchAsyncMessage(mozilla::ipc::ActorLifecycleProxy*, IPC::Message const&) src/ipc/glue/MessageChannel.cpp:2185:25
#12 mozilla::ipc::MessageChannel::DispatchMessage(IPC::Message&&) src/ipc/glue/MessageChannel.cpp:2109:9
#13 mozilla::ipc::MessageChannel::RunMessage(mozilla::ipc::MessageChannel::MessageTask&) src/ipc/glue/MessageChannel.cpp:1954:3
#14 mozilla::ipc::MessageChannel::MessageTask::Run() src/ipc/glue/MessageChannel.cpp:1985:13
#15 nsThread::ProcessNextEvent(bool, bool*) src/xpcom/threads/nsThread.cpp:1225:14
#16 NS_ProcessNextEvent(nsIThread*, bool) src/xpcom/threads/nsThreadUtils.cpp:486:10
#17 mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) src/ipc/glue/MessagePump.cpp:110:5
#18 MessageLoop::RunInternal() src/ipc/chromium/src/base/message_loop.cc:315:10
#19 MessageLoop::Run() src/ipc/chromium/src/base/message_loop.cc:290:3
#20 nsBaseAppShell::Run() src/widget/nsBaseAppShell.cpp:137:27
#21 XRE_RunAppShell() src/toolkit/xre/nsEmbedFunctions.cpp:934:20
#22 mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) src/ipc/glue/MessagePump.cpp:238:9
#23 MessageLoop::RunInternal() src/ipc/chromium/src/base/message_loop.cc:315:10
#24 MessageLoop::Run() src/ipc/chromium/src/base/message_loop.cc:290:3
#25 XRE_InitChildProcess(int, char**, XREChildData const*) src/toolkit/xre/nsEmbedFunctions.cpp:769:34
#26 content_process_main(mozilla::Bootstrap*, int, char**) src/browser/app/../../ipc/contentproc/plugin-container.cpp:56:28
#27 main src/browser/app/nsBrowserApp.cpp:272:18
Flags: in-testsuite?
Attached file prefs.js

The attached test case requires a custom prefs.js

Eitan, any chance one of your pending landings will fix this (maybe bug 1580292)? Or do you think this is a different issue?

Flags: needinfo?(eitan)
Priority: -- → P2
Regressed by: 1576690

No, I think this is another issue. I'll look into this.

Assignee: nobody → eitan
Flags: needinfo?(eitan)
Duplicate of this bug: 1583653
Pushed by jteh@mozilla.com:
https://hg.mozilla.org/integration/autoland/rev/104db8d4ae41
Return null in GetAccessibleOrContainer for text leafs of unrendered maps. r=Jamie
Status: NEW → RESOLVED
Closed: 3 months ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla71
Depends on: 1584297

Is there a user impact which justifies backport consideration or can this fix ride Fx71 to release?

Flags: needinfo?(eitan)
Flags: in-testsuite?
Flags: in-testsuite+

(In reply to Ryan VanderMeulen [:RyanVM] from comment #8)

Is there a user impact which justifies backport consideration or can this fix ride Fx71 to release?

I'd say yes, since this bug appears to fix bug 1584235.

I believe the Eitan is on leave - can you please make the request?

Flags: needinfo?(eitan) → needinfo?(mzehe)

Comment on attachment 9095364 [details]
Bug 1581589 - Return null in GetAccessibleOrContainer for text leafs of unrendered maps. r?Jamie!

Beta/Release Uplift Approval Request

  • User impact if declined: Incorrect/missing accessibles for screen reader users, possible crashes.
  • Is this code covered by automated tests?: Yes
  • Has the fix been verified in Nightly?: Yes
  • Needs manual test from QE?: No
  • If yes, steps to reproduce:
  • List of other uplifts needed: None
  • Risk to taking this patch: Low
  • Why is the change risky/not risky? (and alternatives if risky): Covered by tests, has greater user impact than expected, see comment #9, and has not caused any regressions since landing in Nightly.
  • String changes made/needed: None.
Flags: needinfo?(mzehe)
Attachment #9095364 - Flags: approval-mozilla-beta?

Comment on attachment 9095364 [details]
Bug 1581589 - Return null in GetAccessibleOrContainer for text leafs of unrendered maps. r?Jamie!

Fix for a11y issues and crashes, let's uplift for beta 14.

Attachment #9095364 - Flags: approval-mozilla-beta? → approval-mozilla-beta+
You need to log in before you can comment on or make changes to this bug.