Closed Bug 1800777 Opened 2 years ago Closed 2 years ago

Assertion failure: removed (Can't find old reverse relation), at /builds/worker/checkouts/gecko/accessible/ipc/RemoteAccessibleBase.cpp:933

Categories

(Core :: Disability Access APIs, defect)

defect

Tracking

()

VERIFIED FIXED
109 Branch
Tracking Status
firefox-esr102 --- unaffected
firefox107 --- unaffected
firefox108 --- unaffected
firefox109 --- verified

People

(Reporter: tsmith, Assigned: morgan)

References

(Blocks 1 open bug, Regression)

Details

(Keywords: assertion, regression, testcase, Whiteboard: [bugmon:bisected,confirmed])

Attachments

(3 files)

Attached file testcase.html

Found while fuzzing m-c 20221115-8495494c57f8 (--enable-debug --enable-fuzzing)

To reproduce via Grizzly Replay:

$ pip install fuzzfetch grizzly-framework
$ python -m fuzzfetch -d --fuzzing -n firefox
$ python -m grizzly.replay ./firefox/firefox testcase.html

Assertion failure: removed (Can't find old reverse relation), at /builds/worker/checkouts/gecko/accessible/ipc/RemoteAccessibleBase.cpp:933

#0 0x7f3d28a34697 in mozilla::a11y::RemoteAccessibleBase<mozilla::a11y::RemoteAccessible>::PreProcessRelations(mozilla::a11y::AccAttributes*) /builds/worker/checkouts/gecko/accessible/ipc/RemoteAccessibleBase.cpp:933:11
#1 0x7f3d28a2920a in mozilla::a11y::RemoteAccessibleBase<mozilla::a11y::RemoteAccessible>::ApplyCache(mozilla::a11y::CacheUpdateType, mozilla::a11y::AccAttributes*) /builds/worker/workspace/obj-build/dist/include/mozilla/a11y/RemoteAccessibleBase.h:266:45
#2 0x7f3d28a28d6b in mozilla::a11y::DocAccessibleParent::RecvCache(mozilla::a11y::CacheUpdateType const&, nsTArray<mozilla::a11y::CacheData>&&, bool const&) /builds/worker/checkouts/gecko/accessible/ipc/DocAccessibleParent.cpp:638:13
#3 0x7f3d28a94fb1 in mozilla::a11y::PDocAccessibleParent::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/obj-build/ipc/ipdl/PDocAccessibleParent.cpp:9512:52
#4 0x7f3d2686f65b in mozilla::dom::PContentParent::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/obj-build/ipc/ipdl/PContentParent.cpp:6656:32
#5 0x7f3d22a9730a in mozilla::ipc::MessageChannel::DispatchAsyncMessage(mozilla::ipc::ActorLifecycleProxy*, IPC::Message const&) /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1756:25
#6 0x7f3d22a93f67 in mozilla::ipc::MessageChannel::DispatchMessage(mozilla::ipc::ActorLifecycleProxy*, mozilla::UniquePtr<IPC::Message, mozilla::DefaultDelete<IPC::Message>>) /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1681:9
#7 0x7f3d22a94ab5 in mozilla::ipc::MessageChannel::RunMessage(mozilla::ipc::ActorLifecycleProxy*, mozilla::ipc::MessageChannel::MessageTask&) /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1481:3
#8 0x7f3d22a95def in mozilla::ipc::MessageChannel::MessageTask::Run() /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1579:14
#9 0x7f3d21e96e75 in mozilla::RunnableTask::Run() /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:538:16
#10 0x7f3d21e9245c in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:851:26
#11 0x7f3d21e9102a in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:683:15
#12 0x7f3d21e91385 in mozilla::TaskController::ProcessPendingMTTask(bool) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:461:36
#13 0x7f3d21e9a776 in operator() /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:187:37
#14 0x7f3d21e9a776 in mozilla::detail::RunnableFunction<mozilla::TaskController::InitializeInternal()::$_2>::Run() /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:531:5
#15 0x7f3d21eb0108 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:1204:16
#16 0x7f3d21eb687d in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:465:10
#17 0x7f3d22a9cbe3 in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:85:21
#18 0x7f3d229c2da8 in MessageLoop::RunInternal() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:381:10
#19 0x7f3d229c2cb1 in RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:374:3
#20 0x7f3d229c2cb1 in MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:356:3
#21 0x7f3d26e6a538 in nsBaseAppShell::Run() /builds/worker/checkouts/gecko/widget/nsBaseAppShell.cpp:150:27
#22 0x7f3d28f36cb4 in nsAppStartup::Run() /builds/worker/checkouts/gecko/toolkit/components/startup/nsAppStartup.cpp:295:30
#23 0x7f3d2907e873 in XREMain::XRE_mainRun() /builds/worker/checkouts/gecko/toolkit/xre/nsAppRunner.cpp:5736:22
#24 0x7f3d2907fbb2 in XREMain::XRE_main(int, char**, mozilla::BootstrapConfig const&) /builds/worker/checkouts/gecko/toolkit/xre/nsAppRunner.cpp:5929:8
#25 0x7f3d2908038a in XRE_main(int, char**, mozilla::BootstrapConfig const&) /builds/worker/checkouts/gecko/toolkit/xre/nsAppRunner.cpp:5985:21
#26 0x55a3b33beaec in do_main /builds/worker/checkouts/gecko/browser/app/nsBrowserApp.cpp:226:22
#27 0x55a3b33beaec in main /builds/worker/checkouts/gecko/browser/app/nsBrowserApp.cpp:430:16
#28 0x7f3d35328082 in __libc_start_main /build/glibc-SzIz7B/glibc-2.31/csu/../csu/libc-start.c:308:16
#29 0x55a3b3395248 in _start (/home/worker/builds/m-c-20221115095444-fuzzing-debug/firefox-bin+0x5b248) (BuildId: dffe064ce03c5f235e4a9afc252b16cccb76259f)
Flags: in-testsuite?
Blocks: a11y-ctw
Severity: -- → S4

Morgan, would you mind looking into this? This doesn't seem to cause a real crash, so I've marked it s4 for now. If your investigation reveals this could be a real problem that could crash or otherwise hurt users, it's probably worth fixing now, in which case please re-triage accordingly. If not, we could defer the fix until later. Thanks.

Flags: needinfo?(mreschenberg)

Hmm maybe I'm doing this wrong, but I can't repro this locally.
I ran the python snippets above with the attached test case (and added --enable-fuzzing to my mozconfig + rebuilt) but I get "No results detected"

Is this a platform specific failure?

Flags: needinfo?(mreschenberg) → needinfo?(jteh)

(In reply to Morgan Reschenberg [:morgan] from comment #2)

Is this a platform specific failure?

I can repro on Linux but not Windows.

I have no idea, unfortunately, so comment 3 is your best bet. :(

Flags: needinfo?(jteh)

Would a Pernosco session help? :tsmith, is that possible?

blah I have tested on both linux and mac
:tsmith how are you enabling a11y? are you using GNOME_ACCESSIBILITY or is there another way to inject prefs ?

Flags: needinfo?(twsmith)

I am using prefs.js. You can use prefsjs files with Grizzly via --prefs.

I can try to get a Pernosco session as well.

Attached file prefs.js

A Pernosco session is available here: https://pernos.co/debug/gD6Ch1n08ufzhbqiSvDyiQ/index.html

Flags: needinfo?(twsmith)
Assignee: nobody → mreschenberg
Status: NEW → ASSIGNED

Verified bug as reproducible on mozilla-central 20221118154632-3b5a8f67189b.
The bug appears to have been introduced in the following build range:

Start: 2d625e5d6ff86fda6d83464bb315478f94afc577 (20221114233128)
End: 1adc82d1eb960a8a6aac68b9abceaac3fd491abb (20221115021943)
Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=2d625e5d6ff86fda6d83464bb315478f94afc577&tochange=1adc82d1eb960a8a6aac68b9abceaac3fd491abb

Keywords: regression
Whiteboard: [bugmon:bisected,confirmed]
Pushed by mreschenberg@mozilla.com:
https://hg.mozilla.org/integration/autoland/rev/b5ef57b34bec
Don't recreate reverse rel maps for accs that have been shutdown r=Jamie
Status: ASSIGNED → RESOLVED
Closed: 2 years ago
Resolution: --- → FIXED
Target Milestone: --- → 109 Branch

Verified bug as fixed on rev mozilla-central 20221122094606-bd8c9b741d01.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.

Status: RESOLVED → VERIFIED
Keywords: bugmon
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Created:
Updated:
Size: