Closed Bug 1593396 Opened 15 days ago Closed 9 days ago

Assertion failure: target->IsApplication() || target->IsOuterDoc() || target->IsXULTree() (Only app or outerdoc accessible reorder events are in the queue)

Categories

(Core :: Disability Access APIs, defect, P1)

defect

Tracking

()

RESOLVED FIXED
mozilla72
Tracking Status
firefox72 --- fixed

People

(Reporter: tsmith, Assigned: Jamie)

References

(Blocks 1 open bug)

Details

(Keywords: assertion, testcase, Whiteboard: [fuzzblocker])

Attachments

(2 files)

Attached file testcase.html

Reduced with m-c:
BuildID=20191101215002
SourceStamp=518df4329a20f76b3bffd5f6201b007fdebc274f

Not sure if we are hitting this quite as frequently as bug 1415667 but looking at the test case it will be a lot.

Assertion failure: target->IsApplication() || target->IsOuterDoc() || target->IsXULTree() (Only app or outerdoc accessible reorder events are in the queue), at src/accessible/base/EventQueue.cpp:90

#0 mozilla::a11y::EventQueue::CoalesceEvents() src/accessible/base/EventQueue.cpp:173:23
#1 mozilla::a11y::EventQueue::PushEvent(mozilla::a11y::AccEvent*) src/accessible/base/EventQueue.cpp:37:3
#2 mozilla::a11y::NotificationController::QueueEvent(mozilla::a11y::AccEvent*) src/accessible/base/NotificationController.h:111:9
#3 mozilla::a11y::DocAccessible::DoInitialUpdate() src/accessible/generic/DocAccessible.cpp:1595:23
#4 mozilla::a11y::NotificationController::WillRefresh(mozilla::TimeStamp) src/accessible/base/NotificationController.cpp:636:16
#5 nsRefreshDriver::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) src/layout/base/nsRefreshDriver.cpp:1939:12
#6 mozilla::RefreshDriverTimer::TickRefreshDrivers(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsTArray<RefPtr<nsRefreshDriver> >&) src/layout/base/nsRefreshDriver.cpp:350:7
#7 mozilla::RefreshDriverTimer::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) src/layout/base/nsRefreshDriver.cpp:367:5
#8 mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::TickRefreshDriver(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) src/layout/base/nsRefreshDriver.cpp:727:16
#9 mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::NotifyVsync(mozilla::VsyncEvent const&) src/layout/base/nsRefreshDriver.cpp:622:9
#10 mozilla::layout::VsyncChild::RecvNotify(mozilla::VsyncEvent const&) src/layout/ipc/VsyncChild.cpp:65:16
#11 mozilla::layout::PVsyncChild::OnMessageReceived(IPC::Message const&) src/obj-firefox/ipc/ipdl/PVsyncChild.cpp:187:54
#12 mozilla::ipc::PBackgroundChild::OnMessageReceived(IPC::Message const&) src/obj-firefox/ipc/ipdl/PBackgroundChild.cpp:5876:32
#13 mozilla::ipc::MessageChannel::DispatchAsyncMessage(mozilla::ipc::ActorLifecycleProxy*, IPC::Message const&) src/ipc/glue/MessageChannel.cpp:2208:25
#14 mozilla::ipc::MessageChannel::DispatchMessage(IPC::Message&&) src/ipc/glue/MessageChannel.cpp:2130:9
#15 mozilla::ipc::MessageChannel::RunMessage(mozilla::ipc::MessageChannel::MessageTask&) src/ipc/glue/MessageChannel.cpp:1972:3
#16 mozilla::ipc::MessageChannel::MessageTask::Run() src/ipc/glue/MessageChannel.cpp:2003:13
#17 nsThread::ProcessNextEvent(bool, bool*) src/xpcom/threads/nsThread.cpp:1225:14
#18 NS_ProcessNextEvent(nsIThread*, bool) src/xpcom/threads/nsThreadUtils.cpp:486:10
#19 mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) src/ipc/glue/MessagePump.cpp:110:5
#20 MessageLoop::RunInternal() src/ipc/chromium/src/base/message_loop.cc:315:10
#21 MessageLoop::Run() src/ipc/chromium/src/base/message_loop.cc:290:3
#22 nsBaseAppShell::Run() src/widget/nsBaseAppShell.cpp:137:27
#23 XRE_RunAppShell() src/toolkit/xre/nsEmbedFunctions.cpp:934:20
#24 mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) src/ipc/glue/MessagePump.cpp:238:9
#25 MessageLoop::RunInternal() src/ipc/chromium/src/base/message_loop.cc:315:10
#26 MessageLoop::Run() src/ipc/chromium/src/base/message_loop.cc:290:3
#27 XRE_InitChildProcess(int, char**, XREChildData const*) src/toolkit/xre/nsEmbedFunctions.cpp:769:34
#28 content_process_main(mozilla::Bootstrap*, int, char**) src/browser/app/../../ipc/contentproc/plugin-container.cpp:56:28
#29 main src/browser/app/nsBrowserApp.cpp:272:18
Flags: in-testsuite?

A Pernosco session is available here: https://pernos.co/debug/31IGnURK0sNXuKYZK1T4gQ/index.html
It will expire in 7 days.

I think what's happening here is that the embed starts out as a generic HyperTextAccessible, since we don't know it's going to be an OuterDoc at that point. However, it never gets re-created as an OuterDoc. We're probably going to need an explicit condition to re-create embed (and object) accessibles if their URL changes (src for embed, data for object).

Priority: -- → P1
Assignee: nobody → jteh

If an embed or object doesn't specify a URL (or specifies a URL which isn't web content), it won't be created as an OuterDocAccessible.
For example, an embed with no src will be created as a generic HyperTextAccessible.
If the URL later changes to refer to web content, we must recreate as an OuterDocAccessible.
Previously, we didn't recreate, which was causing an assertion and may have caused other strange issues as well.

Pushed by mzehe@mozilla.com:
https://hg.mozilla.org/integration/autoland/rev/d7bee8f2fa9a
If the content of an embed or object element changes to be web content, recreate as an OuterDocAccessible. r=MarcoZ
Status: NEW → RESOLVED
Closed: 9 days ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla72
You need to log in before you can comment on or make changes to this bug.