Found while fuzzing m-c 20230509-169e7173a60f (--enable-debug --enable-fuzzing)

To reproduce via Grizzly Replay:

$ pip install fuzzfetch grizzly-framework
$ python -m fuzzfetch -d --fuzzing -n firefox
$ python -m grizzly.replay ./firefox/firefox testcase.html

Assertion failure: tag || IsTextLeaf() || IsDoc() (Could not fetch tag via TagName() or from initial cache push!), at /builds/worker/checkouts/gecko/accessible/ipc/RemoteAccessibleBase.cpp:1054

#0 0x7f45d8da08f0 in mozilla::a11y::RemoteAccessibleBase<mozilla::a11y::RemoteAccessible>::PreProcessRelations(mozilla::a11y::AccAttributes*) /builds/worker/checkouts/gecko/accessible/ipc/RemoteAccessibleBase.cpp:1052:7
#1 0x7f45d8d9073a in mozilla::a11y::RemoteAccessibleBase<mozilla::a11y::RemoteAccessible>::ApplyCache(mozilla::a11y::CacheUpdateType, mozilla::a11y::AccAttributes*) /builds/worker/workspace/obj-build/dist/include/mozilla/a11y/RemoteAccessibleBase.h:281:45
#2 0x7f45d8d93748 in mozilla::a11y::DocAccessibleParent::RecvCache(mozilla::a11y::CacheUpdateType const&, nsTArray<mozilla::a11y::CacheData>&&) /builds/worker/checkouts/gecko/accessible/ipc/DocAccessibleParent.cpp:675:13
#3 0x7f45d8e0311b in mozilla::a11y::PDocAccessibleParent::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/obj-build/ipc/ipdl/PDocAccessibleParent.cpp:9773:52
#4 0x7f45d6b13680 in mozilla::dom::PContentParent::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/obj-build/ipc/ipdl/PContentParent.cpp:6689:32
#5 0x7f45d2b1826f in mozilla::ipc::MessageChannel::DispatchAsyncMessage(mozilla::ipc::ActorLifecycleProxy*, IPC::Message const&) /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1800:25
#6 0x7f45d2b14f22 in mozilla::ipc::MessageChannel::DispatchMessage(mozilla::ipc::ActorLifecycleProxy*, mozilla::UniquePtr<IPC::Message, mozilla::DefaultDelete<IPC::Message>>) /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1725:9
#7 0x7f45d2b15a54 in mozilla::ipc::MessageChannel::RunMessage(mozilla::ipc::ActorLifecycleProxy*, mozilla::ipc::MessageChannel::MessageTask&) /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1525:3
#8 0x7f45d2b16d7f in mozilla::ipc::MessageChannel::MessageTask::Run() /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1623:14
#9 0x7f45d1ebbda7 in mozilla::RunnableTask::Run() /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:555:16
#10 0x7f45d1eb6faa in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:879:26
#11 0x7f45d1eb5a87 in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:702:15
#12 0x7f45d1eb5e05 in mozilla::TaskController::ProcessPendingMTTask(bool) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:491:36
#13 0x7f45d1ebf356 in operator() /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:218:37
#14 0x7f45d1ebf356 in mozilla::detail::RunnableFunction<mozilla::TaskController::TaskController()::$_0>::Run() /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.h:548:5
#15 0x7f45d1ed56fa in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:1239:16
#16 0x7f45d1edbd1d in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:479:10
#17 0x7f45d2b1e215 in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:85:21
#18 0x7f45d2a3fdd1 in RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:362:3
#19 0x7f45d2a3fdd1 in MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:344:3
#20 0x7f45d7182e08 in nsBaseAppShell::Run() /builds/worker/checkouts/gecko/widget/nsBaseAppShell.cpp:148:27
#21 0x7f45d92cbdc4 in nsAppStartup::Run() /builds/worker/checkouts/gecko/toolkit/components/startup/nsAppStartup.cpp:295:30
#22 0x7f45d940f683 in XREMain::XRE_mainRun() /builds/worker/checkouts/gecko/toolkit/xre/nsAppRunner.cpp:5657:22
#23 0x7f45d9410972 in XREMain::XRE_main(int, char**, mozilla::BootstrapConfig const&) /builds/worker/checkouts/gecko/toolkit/xre/nsAppRunner.cpp:5857:8
#24 0x7f45d9411152 in XRE_main(int, char**, mozilla::BootstrapConfig const&) /builds/worker/checkouts/gecko/toolkit/xre/nsAppRunner.cpp:5913:21
#25 0x5595f08356b7 in do_main /builds/worker/checkouts/gecko/browser/app/nsBrowserApp.cpp:227:22
#26 0x5595f08356b7 in main /builds/worker/checkouts/gecko/browser/app/nsBrowserApp.cpp:445:16
#27 0x7f45e5629d8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
#28 0x7f45e5629e3f in __libc_start_main csu/../csu/libc-start.c:392:3
#29 0x5595f080ca28 in _start (/home/user/workspace/browsers/m-c-20230510213701-fuzzing-debug/firefox-bin+0x58a28) (BuildId: 62943f22fb28e316d9baf2fbed5d93553833dc4a)

prefs.js file for bugmon

Verified bug as reproducible on mozilla-central 20230511213213-375c5940c253.
The bug appears to have been introduced in the following build range:

Start: a7a328c86d5bab5e73de7abf526304c96addccc3 (20230508201033)
End: cc7b419c4bbea93ee3364cf6749a0d6dcbb0a991 (20230508213519)
Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=a7a328c86d5bab5e73de7abf526304c96addccc3&tochange=cc7b419c4bbea93ee3364cf6749a0d6dcbb0a991

:morgan based on the above range, could this be regressed by bug 1825611?

This is more likely caused by bug 1455416.

Set release status flags based on info from the regressing bug 1455416

:nlapre, since you are the author of the regressor, bug 1455416, could you take a look? Also, could you set the severity field?

For more information, please visit BugBot documentation.

Setting 115 to Fixed as the regressor Bug 1455416 was backed out of central

Fixed by backout.

Verified bug as fixed on rev mozilla-central 20230519041011-d97636946466.