Assertion failure: container (Text node having rendered text hasn't accessible document!), at src/accessible/base/NotificationController.cpp:717 #0 0x7f53e199ca3f in mozilla::a11y::NotificationController::WillRefresh(mozilla::TimeStamp) src/accessible/base/NotificationController.cpp:886:25 #1 0x7f53df27a1bb in nsRefreshDriver::Tick(long, mozilla::TimeStamp) src/layout/base/nsRefreshDriver.cpp:1886:12 #2 0x7f53df28394e in mozilla::RefreshDriverTimer::TickRefreshDrivers(long, mozilla::TimeStamp, nsTArray<RefPtr<nsRefreshDriver> >&) src/layout/base/nsRefreshDriver.cpp:307:7 #3 0x7f53df283724 in mozilla::RefreshDriverTimer::Tick(long, mozilla::TimeStamp) src/layout/base/nsRefreshDriver.cpp:328:5 #4 0x7f53df286d15 in mozilla::VsyncRefreshDriverTimer::RunRefreshDrivers(mozilla::TimeStamp) src/layout/base/nsRefreshDriver.cpp:770:5 #5 0x7f53df285db6 in mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::TickRefreshDriver(mozilla::TimeStamp) src/layout/base/nsRefreshDriver.cpp:683:35 #6 0x7f53df281d27 in mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::ParentProcessVsyncNotifier::Run() src/layout/base/nsRefreshDriver.cpp:529:20 #7 0x7f53d999d96f in nsThread::ProcessNextEvent(bool, bool*) src/xpcom/threads/nsThread.cpp:1039:14 #8 0x7f53d99a2810 in NS_ProcessNextEvent(nsIThread*, bool) src/xpcom/threads/nsThreadUtils.cpp:521:10 #9 0x7f53da50f025 in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) src/ipc/glue/MessagePump.cpp:97:21 #10 0x7f53da45fae7 in MessageLoop::RunInternal() src/ipc/chromium/src/base/message_loop.cc:326:10 #11 0x7f53da45f979 in MessageLoop::Run() src/ipc/chromium/src/base/message_loop.cc:299:3 #12 0x7f53ded7c6ea in nsBaseAppShell::Run() src/widget/nsBaseAppShell.cpp:158:27 #13 0x7f53e1f65d51 in nsAppStartup::Run() src/toolkit/components/startup/nsAppStartup.cpp:288:30 #14 0x7f53e20c984e in XREMain::XRE_mainRun() src/toolkit/xre/nsAppRunner.cpp:4643:22 #15 0x7f53e20cb4fa in XREMain::XRE_main(int, char**, mozilla::BootstrapConfig const&) src/toolkit/xre/nsAppRunner.cpp:4807:8 #16 0x7f53e20cc3e8 in XRE_main(int, char**, mozilla::BootstrapConfig const&) src/toolkit/xre/nsAppRunner.cpp:4902:21 #17 0x4ecb68 in do_main(int, char**, char**) src/browser/app/nsBrowserApp.cpp:236:22 #18 0x4ec480 in main src/browser/app/nsBrowserApp.cpp:309:16 #19 0x7f53f893e82f in __libc_start_main /build/glibc-bfm8X4/glibc-2.23/csu/../csu/libc-start.c:291 #20 0x41e1b4 in _start (firefox+0x41e1b4)

Still reproduces on trunk. Goes back more than a year (which is as far back as mozregression can bisect debug builds).

I am hitting this fairly frequently while fuzzing.

David, can we bump the priority on this to help unblock our fuzzers?

Eitan, do you have cycles to check this one, to figure out what's going on here? It could be related with one of text updates problems we were looking a while ago.

Comment on attachment 8935172 [details] [diff] [review] Don't process text changes from nodes that were removed from doc. r?surkov Review of attachment 8935172 [details] [diff] [review]: ----------------------------------------------------------------- nice! ::: accessible/base/NotificationController.cpp @@ +655,2 @@ > NS_ASSERTION(!textAcc, > "Text node was removed but accessible is kept alive!"); please replace it on MOZ_ASSERT while you are here.

Pushed by csabou@mozilla.com: https://hg.mozilla.org/integration/mozilla-inbound/rev/62ebba5a426a Don't process text changes from nodes that were removed from doc. r=surkov

Is this something we should consider uplifting to Beta or can it ride the 59 train? Also, can the attached testcase be landed as a crashtest?

I don't think we need to uplift this.

Comment on attachment 8936614 [details] [diff] [review] Add a crashtest. r?RyanVM Review of attachment 8936614 [details] [diff] [review]: ----------------------------------------------------------------- Did you forget to hg add the test?

Perhaps I forgot something earlier!

Pushed by ryanvm@gmail.com: https://hg.mozilla.org/integration/mozilla-inbound/rev/47637ccbabfd Add a crashtest. r=RyanVM

Backed out changeset 47637ccbabfd (bug 1396478) for leaks on a newly-added accessability test on a CLOSED TREE https://treeherder.mozilla.org/logviewer.html#?job_id=152997513&repo=mozilla-inbound&lineNumber=63618 https://hg.mozilla.org/integration/mozilla-inbound/rev/ea133532d0535f40717f177e9eef93b1ed39c77e https://treeherder.mozilla.org/#/jobs?repo=mozilla-inbound&revision=47637ccbabfd7ded68c061e4bd2eb624e396c2de