Closed
Bug 1415960
Opened 8 years ago
Closed 4 years ago
Assertion failure: false (MOZ_ASSERT_UNREACHABLE: Broken accessible tree) [@ mozilla::a11y::Accessible::InsertAfter]
Categories
(Core :: Disability Access APIs, defect, P2)
Tracking
()
People
(Reporter: tsmith, Assigned: eeejay)
References
(Blocks 1 open bug)
Details
(Keywords: assertion, testcase, Whiteboard: [a11y:crash-tree][fuzzblocker])
Attachments
(2 files)
Assertion failure: false (MOZ_ASSERT_UNREACHABLE: Broken accessible tree), at /src/accessible/generic/Accessible-inl.h:129
#0 mozilla::a11y::Accessible::InsertAfter(mozilla::a11y::Accessible*, mozilla::a11y::Accessible*) /src/accessible/generic/Accessible-inl.h:134:47
#1 mozilla::a11y::DocAccessible::ProcessContentInserted(mozilla::a11y::Accessible*, nsIContent*) /src/accessible/generic/DocAccessible.cpp:1962:24
#2 mozilla::a11y::DocAccessible::ProcessInvalidationList() /src/accessible/generic/DocAccessible.cpp:1425:13
#3 mozilla::a11y::NotificationController::WillRefresh(mozilla::TimeStamp) /src/accessible/base/NotificationController.cpp:812:14
#4 nsRefreshDriver::Tick(long, mozilla::TimeStamp) /src/layout/base/nsRefreshDriver.cpp:1843:12
#5 mozilla::RefreshDriverTimer::TickRefreshDrivers(long, mozilla::TimeStamp, nsTArray<RefPtr<nsRefreshDriver> >&) /src/layout/base/nsRefreshDriver.cpp:306:7
#6 mozilla::RefreshDriverTimer::Tick(long, mozilla::TimeStamp) /src/layout/base/nsRefreshDriver.cpp:328:5
#7 mozilla::VsyncRefreshDriverTimer::RunRefreshDrivers(mozilla::TimeStamp) /src/layout/base/nsRefreshDriver.cpp:769:5
#8 mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::TickRefreshDriver(mozilla::TimeStamp) /src/layout/base/nsRefreshDriver.cpp:682:35
#9 mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::NotifyVsync(mozilla::TimeStamp) /src/layout/base/nsRefreshDriver.cpp:583:9
#10 mozilla::layout::VsyncChild::RecvNotify(mozilla::TimeStamp const&) /src/layout/ipc/VsyncChild.cpp:68:16
#11 mozilla::layout::PVsyncChild::OnMessageReceived(IPC::Message const&) /src/obj-firefox/ipc/ipdl/PVsyncChild.cpp:155:20
#12 mozilla::ipc::PBackgroundChild::OnMessageReceived(IPC::Message const&) /src/obj-firefox/ipc/ipdl/PBackgroundChild.cpp:1815:28
#13 mozilla::ipc::MessageChannel::DispatchAsyncMessage(IPC::Message const&) /src/ipc/glue/MessageChannel.cpp:2119:25
#14 mozilla::ipc::MessageChannel::DispatchMessage(IPC::Message&&) /src/ipc/glue/MessageChannel.cpp:2049:17
#15 mozilla::ipc::MessageChannel::RunMessage(mozilla::ipc::MessageChannel::MessageTask&) /src/ipc/glue/MessageChannel.cpp:1895:5
#16 mozilla::ipc::MessageChannel::MessageTask::Run() /src/ipc/glue/MessageChannel.cpp:1928:15
#17 nsThread::ProcessNextEvent(bool, bool*) /src/xpcom/threads/nsThread.cpp:1037:14
#18 NS_ProcessNextEvent(nsIThread*, bool) /src/xpcom/threads/nsThreadUtils.cpp:513:10
#19 mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /src/ipc/glue/MessagePump.cpp:97:21
#20 MessageLoop::RunInternal() /src/ipc/chromium/src/base/message_loop.cc:326:10
#21 MessageLoop::Run() /src/ipc/chromium/src/base/message_loop.cc:299:3
#22 nsBaseAppShell::Run() /src/widget/nsBaseAppShell.cpp:158:27
#23 XRE_RunAppShell() /src/toolkit/xre/nsEmbedFunctions.cpp:877:22
#24 mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) /src/ipc/glue/MessagePump.cpp:269:9
#25 MessageLoop::RunInternal() /src/ipc/chromium/src/base/message_loop.cc:326:10
#26 MessageLoop::Run() /src/ipc/chromium/src/base/message_loop.cc:299:3
#27 XRE_InitChildProcess(int, char**, XREChildData const*) /src/toolkit/xre/nsEmbedFunctions.cpp:703:34
#28 content_process_main(mozilla::Bootstrap*, int, char**) /src/browser/app/../../ipc/contentproc/plugin-container.cpp:63:30
#29 main /src/browser/app/nsBrowserApp.cpp:280:18
#30 __libc_start_main /build/glibc-bfm8X4/glibc-2.23/csu/../csu/libc-start.c:291
#31 _start (firefox+0x41ebe4)
Flags: in-testsuite?
|
||
Updated•8 years ago
|
Priority: -- → P2
|
||
Comment 1•8 years ago
|
||
Goes back more than a year.
|
|
||
Updated•7 years ago
|
Whiteboard: a11y:crash-tree
|
Reporter | |
Comment 2•5 years ago
|
||
Another issue that has been around for a long time and the fuzzers continue to trip over it. Marking as fuzzblocker[1] (very simple test case likely going to spike once other fuzzblockers are resolved). Jamie can you please find someone to have a look if possible? Thank you.
[1] https://firefox-source-docs.mozilla.org/tools/fuzzing/index.html#fuzz-blockers
Flags: needinfo?(jteh)
Whiteboard: a11y:crash-tree → [a11y:crash-tree][fuzzblocker]
|
||
Comment 3•5 years ago
|
||
When I load this, the marquee accessible has a child for a div with class "horizontalInnerDiv". This must be shadow DOM or anonymous. This very likely has something to do with this, but I don't quite understand what. Maybe we get the wrong container accessible in this case?
|
|
||
Updated•5 years ago
|
Assignee: nobody → eitan
|
Assignee | |
Comment 4•4 years ago
|
||
This fixes an inconsistency where CacheChildrenInSubtree uses the
flattened tree via DOM child iterators, but ProcessInvalidationList uses
GetContainerAccessible that doesn't currently use the flattened tree.
Pushed by eisaacson@mozilla.com:
https://hg.mozilla.org/integration/autoland/rev/d864e55afead
Use flattened tree parent when returning GetContainerAccessible. r=Jamie
|
||
Comment 6•4 years ago
|
||
| bugherder | ||
Status: NEW → RESOLVED
Closed: 4 years ago
status-firefox89:
--- → fixed
Resolution: --- → FIXED
Target Milestone: --- → 89 Branch
|
|
||
Updated•4 years ago
|
status-firefox86:
--- → wontfix
status-firefox87:
--- → wontfix
status-firefox88:
--- → wontfix
status-firefox-esr78:
--- → wontfix
Flags: needinfo?(jteh)
Flags: in-testsuite?
Flags: in-testsuite+
You need to log in
before you can comment on or make changes to this bug.
Description
•