2008970 - Crash in [@ mozilla::dom::TreeOrderedArray<T>::Insert::PositionComparator::operator()]

Status: RESOLVED FIXED

(Core :: Disability Access APIs, defect)

Description

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

This causes many crashes with the latest Nightly build (148.0a1 20260107083313). Nightly updates have been halted and the changes which causes this will be backed out.

Crash report: https://crash-stats.mozilla.org/report/index/1fb4d96d-744d-4d2a-85ba-704a40260107

MOZ_CRASH Reason:

MOZ_DIAGNOSTIC_ASSERT(curNode != &mNode) (Tried to insert a node already in the list)

Top 10 frames:

0  XUL  MOZ_CrashSequence(void*, long)  mfbt/Assertions.h:242
0  XUL  mozilla::dom::TreeOrderedArray<nsIContent*, (TreeKind)1>::Insert(nsIContent&,...  dom/base/TreeOrderedArrayInlines.h:37
1  XUL  mozilla::dom::TreeOrderedArray<nsIContent*, (TreeKind)1>::Insert(nsIContent&,...  dom/base/TreeOrderedArrayInlines.h:45
2  XUL  mozilla::a11y::RelatedAccIterator::Initialize()  accessible/base/AccIterator.cpp:99
3  XUL  mozilla::a11y::RelatedAccIterator::Next()  accessible/base/AccIterator.cpp:134
4  XUL  mozilla::a11y::DocAccessible::QueueCacheUpdateForDependentRelations(mozilla::...  accessible/generic/DocAccessible.cpp:463
5  XUL  mozilla::a11y::DocAccessible::BindToDocument(mozilla::a11y::LocalAccessible*,...  accessible/generic/DocAccessible.cpp:1362
6  XUL  nsAccessibilityService::CreateAccessible(nsINode*, mozilla::a11y::LocalAccess...  accessible/base/nsAccessibilityService.cpp:0
7  XUL  mozilla::a11y::DocAccessible::DoARIAOwnsRelocation(mozilla::a11y::LocalAccess...  accessible/generic/DocAccessible.cpp:2666
8  XUL  mozilla::a11y::NotificationController::WillRefresh(mozilla::TimeStamp)  accessible/base/NotificationController.cpp:984

Comment 1

[Alice Boxhall]

This should be fixed by the fix for https://bugzilla.mozilla.org/show_bug.cgi?id=2008810.

Comment 2

[Morgan Reschenberg [:morgan]]

Adding in case it is helpful in distilling a test case: I can reliably trigger this on macOS by going to google drive and hitting the "new+" button to create a new document.

Comment 3

[Donal Meehan [:dmeehan]]

The regressor Bug 1981346 was backed out and new nightly builds are available.