1655652 - Assertion in Accessible::IsDefunct when installing an addon from file

Status: RESOLVED FIXED

(Core :: Disability Access APIs, defect)

Description

[Paul Bone [:pbone]]

Attachment: bug2.zip

I get an assertion here:

Assertion failure: mStateFlags & eIsDefunct || IsApplication() || IsDoc() || mStateFlags & eSharedNode || mContent (No content), at /mnt/dev/moz/fission2/accessible/generic/Accessible-inl.h:95

#0 0x00007fb49a752505 in mozilla::a11y::Accessible::IsDefunct() const (this=0x7fb463dcccf0) at /mnt/dev/moz/fission2/accessible/generic/Accessible-inl.h:93
#1 0x00007fb49a7cf080 in mozilla::a11y::Accessible::RemoveChild(mozilla::a11y::Accessible*) (this=0x7fb47fdd47b0, aChild=0x7fb463dcccf0)
at /mnt/dev/moz/fission2/accessible/generic/Accessible.cpp:2172
#2 0x00007fb49a755e0a in mozilla::a11y::ApplicationAccessibleWrap::RemoveChild(mozilla::a11y::Accessible*) (this=0x7fb47fdd47b0, aChild=0x7fb463dcccf0)
at /mnt/dev/moz/fission2/accessible/atk/ApplicationAccessibleWrap.cpp:144
#3 0x00007fb49a7a7c69 in nsAccessibilityService::RemoveNativeRootAccessible(mozilla::a11y::Accessible*) (this=0x7fb4ab220aa0, aAccessible=0x7fb463dcccf0)
at /mnt/dev/moz/fission2/accessible/base/nsAccessibilityService.cpp:1555
#4 0x00007fb49a755aa7 in toplevel_event_watcher(_GSignalInvocationHint*, unsigned int, _GValue const*, void*) (ihint=0x7ffcd78f78b0, n_param_values=1, param_values=0x7ffcd78f7930, data=0x2)
at /mnt/dev/moz/fission2/accessible/atk/ApplicationAccessibleWrap.cpp:60
#5 0x00007fb4a70cafd8 in () at /usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0
#6 0x00007fb4a70d3715 in g_signal_emit_valist ()
at /usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0
#7 0x00007fb4a70d412f in g_signal_emit ()
at /usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0
#8 0x00007fb4a9dbc285 in gtk_widget_hide ()
at /usr/lib/x86_64-linux-gnu/libgtk-3.so.0
#9 0x00007fb4a9dbc4a5 in () at /usr/lib/x86_64-linux-gnu/libgtk-3.so.0
#10 0x00007fb4a9dd0008 in () at /usr/lib/x86_64-linux-gnu/libgtk-3.so.0
#11 0x00007fb4a70be7e8 in g_object_run_dispose ()
at /usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0
#12 0x00007fb497e8379f in nsFilePicker::GtkFileChooserDestroy(void*) (this=
0x7fb3d7415120, file_chooser=0x7fb443983ab0)
at /mnt/dev/moz/fission2/widget/gtk/nsFilePicker.cpp:628
#13 0x00007fb497e835c8 in nsFilePicker::Done(void*, int) (this=0x7fb3d7415120, file_chooser=0x7fb443983ab0, response=-3)
at /mnt/dev/moz/fission2/widget/gtk/nsFilePicker.cpp:552
#14 0x00007fb497e83276 in nsFilePicker::OnResponse(void*, int, void*) (file_chooser=0x7fb443983ab0, response_id=-3, user_data=0x7fb3d7415120)
at /mnt/dev/moz/fission2/widget/gtk/nsFilePicker.cpp:501
#15 0x00007fb4a70b810d in g_closure_invoke ()
at /usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0
#16 0x00007fb4a70cb05e in () at /usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0
#17 0x00007fb4a70d3715 in g_signal_emit_valist ()

When I try to install an addon from a file. STR:

• Open about:addons
• click the gear icon near the top of addons screen.
• In the menu that appears choose "Install Add-on From File"
• Choose the attached zip file
• When clicking "Open" in the file chooser the browser crashes with the above assertion. This is a local build with --enable-debug

Comment 1

[Paul Bone [:pbone]]

It only happens in debug builds, don't expect to reproduce it on nightly.

Comment 2

[James Teh [:Jamie]]

We hook native GTK window accessibles into our tree using GtkWindowAccessible, which subclasses DummyAccessible. When one of these windows gets destroyed, we remove it from our tree. That causes us to check IsDefunct(), which in turn causes us to assert various things. A DummyAccessible will never meet these conditions.

There are two solutions here:

1. We could add an AccType for DummyAccessible and add this to the IsDefunct assert. This feels like wasting an AccType for a tiny use case, though.
2. We could set something like eSharedNode on DummyAccessible::mStateFlags to satisfy the IsDefunct assertion. This is a bit of a hack, since it doesn't share a DOM node; it isn't in the DOM at all. However, we treat it in a similar way: it doesn't have "content" as far as we are concerned.

Eitan, can you live with (2)? or do you really want (1)? or do you have a better idea?

Comment 3

[Eitan Isaacson [:eeejay]]

2 sounds great! Thanks for looking into this.

Comment 4

[James Teh [:Jamie]]

Attachment: Bug 1655652: Prevent bogus assertion in IsDefunct() for DummyAccessibles.

Comment 5

[James Teh [:Jamie]]

Paul, if you get a chance, would you mind testing the patch to see if it fixes this for you? Thanks.

Comment 6

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/59c1bffc2e2d
Prevent bogus assertion in IsDefunct() for DummyAccessibles. r=eeejay

Comment 7

[Alexandru Michis [:malexandru]]

https://hg.mozilla.org/mozilla-central/rev/59c1bffc2e2d