1678873 - Crash in [@ mozilla::PresShell::DoFlushPendingNotifications]

Status: RESOLVED FIXED

(Core :: Disability Access APIs, defect)

Description

[Alice0775 White]

Crash report: https://crash-stats.mozilla.org/report/index/6f31d3db-d31c-4ad3-b974-8059a0201121

MOZ_CRASH Reason: MOZ_DIAGNOSTIC_ASSERT(!mForbiddenToFlush) (This is bad!)

Top 10 frames of crashing thread:

0 xul.dll mozilla::PresShell::DoFlushPendingNotifications layout/base/PresShell.cpp:4075
1 xul.dll mozilla::dom::Document::FlushPendingNotifications dom/base/Document.cpp:10279
2 xul.dll mozilla::dom::XULTreeElement::GetTreeBodyFrame dom/xul/XULTreeElement.cpp:93
3 xul.dll mozilla::dom::XULTreeElement::GetView dom/xul/XULTreeElement.cpp:111
4 xul.dll mozilla::a11y::XULTreeColumAccessible::GetSiblingAtOffset const accessible/xul/XULTreeAccessible.cpp:984
5 xul.dll mozilla::a11y::AccHideEvent::AccHideEvent accessible/base/AccEvent.cpp:106
6 xul.dll mozilla::a11y::TreeMutation::BeforeRemoval accessible/base/EventTree.cpp:85
7 xul.dll mozilla::a11y::DocAccessible::ContentRemoved accessible/generic/DocAccessible.cpp:2125
8 xul.dll mozilla::a11y::DocAccessible::ContentRemoved accessible/generic/DocAccessible.cpp:2154
9 xul.dll mozilla::a11y::DocAccessible::PruneOrInsertSubtree accessible/generic/DocAccessible.cpp:1399

Reproducible: always

Steps to Reproduce:

1. Start Nightly with new profile
2. Ctrl+Shift+O to open Library
3. Click Downloads on the left pane

Actual Results:
Browser crashes with crash reporter

Comment 1

[Alice0775 White]

Regression window:
https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=35f3e90b365788ba92a19cdd540d9cc3a989607d&tochange=106d5e1398899929d8f9d99ceb6afd32e7d935fd

Comment 2

[BugBot [:suhaib / :marco/ :calixte]]

Bugbug thinks this bug should belong to this component, but please revert this change in case of error.

Comment 3

[Tim Nguyen :ntim]

Alice0775, Thanks for finding this crash!

Unlikely, but bug 1678860 might help with this, though I can't tell for sure since I can't reproduce this on macOS.

I suspect the <tree> is not happy about dynamically getting display: none, since it's probably destroying the tree at the same time.
Possible workarounds would be:

• Adding a wrapper around #placeContent and toggling that (would need to audit if nothing is relying on the current structure though)
• Using collapsed instead of hidden (which I think was built for this use-case)

Emilio, do you think this correct? Does the crash reveal a bug elsewhere? (e.g. a11y code which appears in the trace)

Comment 4

[Alice0775 White]

Additional info:
I can confirm that a11y is needed to reproduce the crash.

• Nightly crashes if Windows Narrator is activated
• Nightly crashes if ATOK Japanese IME is enabled

Comment 5

[Emilio Cobos Álvarez (:emilio)]

None of those are the right fix. The right fix is for the a11y code not to do reentrant flushes. I think the relevant code in here should not flush, and for that GetView should probably get a FlushType argument just like GetTreeBodyFrame has.

Comment 6

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

Bug 1678523 has been backed out and the next Nightly (which should be available in ~3 hours) should be fixed.

Comment 7

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

James, please coordinate with Tim how to fix the code mentioned in comment 5 so bug 1678523 can land again.

Comment 8

[Tim Nguyen :ntim]

I've relanded bug 1678523 with the fix suggested in comment 5, hopefully it will work. It doesn't have a crash test, but probably should (I'm not too familiar with how to enable a11y features in tests).

Comment 9

[Tim Nguyen :ntim]

Alice0775, could you please check if the crash is fixed by this build (available as target.zip in the Artifacts tab)? I unfortunately don't have Windows to test this. Thanks!

Comment 10

[Alice0775 White]

(In reply to Tim Nguyen :ntim from comment #9)

Alice0775, could you please check if the crash is fixed by this build (available as target.zip in the Artifacts tab)? I unfortunately don't have Windows to test this. Thanks!

The build works fine. No crash.

Comment 11

[Tim Nguyen :ntim]

Thanks!