Assertion failure: static_cast<uint32_t>(aChild->mIndexInParent) != aNewIndex (No move, same index), at src/accessible/generic/Accessible.cpp:2185 #0 0x7f5d8e8ce836 in mozilla::a11y::Accessible::MoveChild(unsigned int, mozilla::a11y::Accessible*) src/accessible/generic/Accessible.cpp:2183:3 #1 0x7f5d8e8ec6ff in mozilla::a11y::DocAccessible::MoveChild(mozilla::a11y::Accessible*, mozilla::a11y::Accessible*, int) src/accessible/generic/DocAccessible.cpp:2219:16 #2 0x7f5d8e8ecc70 in mozilla::a11y::DocAccessible::PutChildrenBack(nsTArray<RefPtr<mozilla::a11y::Accessible> >*, unsigned int) src/accessible/generic/DocAccessible.cpp:2184:5 #3 0x7f5d8e8ebbad in mozilla::a11y::DocAccessible::DoARIAOwnsRelocation(mozilla::a11y::Accessible*) src/accessible/generic/DocAccessible.cpp:2136:3 #4 0x7f5d8e85c75c in mozilla::a11y::NotificationController::WillRefresh(mozilla::TimeStamp) src/accessible/base/NotificationController.cpp:811:18 #5 0x7f5d8b691625 in nsRefreshDriver::Tick(long, mozilla::TimeStamp) src/layout/base/nsRefreshDriver.cpp:1827:12 #6 0x7f5d8b6a0a75 in mozilla::RefreshDriverTimer::TickRefreshDrivers(long, mozilla::TimeStamp, nsTArray<RefPtr<nsRefreshDriver> >&) src/layout/base/nsRefreshDriver.cpp:297:7 #7 0x7f5d8b6a0732 in mozilla::RefreshDriverTimer::Tick(long, mozilla::TimeStamp) src/layout/base/nsRefreshDriver.cpp:318:5 #8 0x7f5d8b6a2e5b in RunRefreshDrivers src/layout/base/nsRefreshDriver.cpp:750:5 #9 0x7f5d8b6a2e5b in mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::TickRefreshDriver(mozilla::TimeStamp) src/layout/base/nsRefreshDriver.cpp:663 #10 0x7f5d8b69e137 in mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::ParentProcessVsyncNotifier::Run() src/layout/base/nsRefreshDriver.cpp:509:20 #11 0x7f5d84cc0e08 in nsThread::ProcessNextEvent(bool, bool*) src/xpcom/threads/nsThread.cpp:1421:14 #12 0x7f5d84cc6f58 in NS_ProcessNextEvent(nsIThread*, bool) src/xpcom/threads/nsThreadUtils.cpp:471:10 #13 0x7f5d85a85ec1 in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) src/ipc/glue/MessagePump.cpp:96:21 #14 0x7f5d859e2850 in RunInternal src/ipc/chromium/src/base/message_loop.cc:320:10 #15 0x7f5d859e2850 in RunHandler src/ipc/chromium/src/base/message_loop.cc:313 #16 0x7f5d859e2850 in MessageLoop::Run() src/ipc/chromium/src/base/message_loop.cc:293 #17 0x7f5d8b001ecf in nsBaseAppShell::Run() src/widget/nsBaseAppShell.cpp:156:27 #18 0x7f5d8f0596a1 in nsAppStartup::Run() src/toolkit/components/startup/nsAppStartup.cpp:283:30 #19 0x7f5d8f227674 in XREMain::XRE_mainRun() src/toolkit/xre/nsAppRunner.cpp:4590:22 #20 0x7f5d8f2291e0 in XREMain::XRE_main(int, char**, mozilla::BootstrapConfig const&) src/toolkit/xre/nsAppRunner.cpp:4774:8 #21 0x7f5d8f22a531 in XRE_main(int, char**, mozilla::BootstrapConfig const&) src/toolkit/xre/nsAppRunner.cpp:4869:21 #22 0x4eb613 in do_main src/browser/app/nsBrowserApp.cpp:237:22 #23 0x4eb613 in main src/browser/app/nsBrowserApp.cpp:310 #24 0x7f5da196b82f in __libc_start_main /build/glibc-bfm8X4/glibc-2.23/csu/../csu/libc-start.c:291 #25 0x41d168 in _start (m-c-1498253338-asan-opt/firefox+0x41d168)

Comment on attachment 8884451 [details] [diff] [review] Check if we are re-aria-owning a child into its current index. r?surkov Review of attachment 8884451 [details] [diff] [review]: ----------------------------------------------------------------- ::: accessible/generic/DocAccessible.cpp @@ -2108,5 @@ > > // Same child on same position, no change. > - if (child->Parent() == aOwner && > - child->IndexInParent() == static_cast<int32_t>(insertIdx)) { > - MOZ_ASSERT(owned->ElementAt(idx) == child, "Not in sync!"); is there a short example where it happens or some explanation of this? The patch (IsRelocated() condition specifically) makes me think that IndexInParent == insertIdx for ordinal (not relocated) child, which should be sort of impossible, since insertIdx points after all ordinal children. @@ +2111,5 @@ > + int32_t indexInParent = child->IndexInParent(); > + // Either the child is being placed in its current index, or directly > + // after its current index, which is a no-op. > + if (indexInParent == static_cast<int32_t>(insertIdx) || > + indexInParent == static_cast<int32_t>(insertIdx) - 1) { also I don't follow the second clause; the first one is designed to skip unchanged bits of aria-owns, for example, when aria-owns='id1 id2 id3' is changed to aria-owns='id3 id2 id1', and id2 is no change case.

Comment on attachment 8884451 [details] [diff] [review] Check if we are re-aria-owning a child into its current index. r?surkov Please disregard this patch. It doesn't fix this issue.

Here is a simplified case that hits this issue. The child is initially loaded as "relocated" into its own parent. When aria-owns attribute is removed, it gets inserted into the same place.

Comment on attachment 8887585 [details] [diff] [review] Create redundant aria-owned children as not relocated. r?surkov This may be wrong, holding off.

The patch in bug 1378257 will fix this too.

A fix should be in tomorrow's nightly. Tyson, can you confirm the fix and close this?

bug 1378257 adds tests

I can no longer reproduce this issue on m-c. Changeset: 16ffc1d05422a81099ce8b9b59de66dde4c8b2f0 Build ID: 20170728132457