Bug 1585851: When processing a11y insertions, don't try to move an accessible if its new previous sibling hasn't been moved into its new container yet. r=MarcoZ

Sometimes, depending on how children were changed, children might be in the insertion list out of order; e.g. [child2, child1].
It's also possible that an earlier child (child1 in the above example) is being moved out of another container.
When processing the earlier insertion (child2), we'll determine we need to move it within its parent and will fetch its new previous sibling so we can move it into the right place.
However, in this case, the new previous sibling (child1) will be in the wrong container.
We can't move in that case; the new previous sibling's index in parent will obviously be wrong, since it's relative to the wrong container.
Therefore, we just skip the move.
Since the previous sibling (child1) is later in the insertion list, the ordering will be corrected when we process that insertion.

Differential Revision: https://phabricator.services.mozilla.com/D51037

--HG--
extra : moz-landing-system : lando

accessible/generic/DocAccessible.cpp

@@ -1941,6 +1941,14 @@ void DocAccessible::ProcessContentInserted(
       Accessible* previousSibling = iter.ChildBefore();
       if (parent != aContainer ||
           iter.Child()->PrevSibling() != previousSibling) {
+        if (previousSibling && previousSibling->Parent() != aContainer) {
+          // previousSibling hasn't been moved into aContainer yet.
+          // previousSibling should be later in the insertion list, so the tree
+          // will get adjusted when we process it later.
+          MOZ_DIAGNOSTIC_ASSERT(parent == aContainer,
+            "Child moving to new parent, but previous sibling in wrong parent");
+          continue;
+        }
 #ifdef A11Y_LOG
         logging::TreeInfo("relocating accessible", 0, "old parent", parent,
                           "new parent", aContainer, "child", iter.Child(),

accessible/tests/crashtests/1585851.html

@@ -0,0 +1,21 @@
+<style>
+* {
+  border-collapse: collapse;
+}
+</style>
+<script>
+window.onload = () => {
+  c.style.setProperty("border-collapse", "separate")
+}
+function eh() {
+  a.options.add(f)
+  a.add(b, 9)
+  a.add(f, d)
+}
+</script>
+<select id="a"></select>
+<option id="b">
+<dd id="c">
+<audio id="d" controls>
+<details open="true" ontoggle="eh()">
+<optgroup id="f">

accessible/tests/crashtests/crashtests.list

@@ -13,6 +13,7 @@ load 1484778.html
 load 1494707.html
 load 1503964.html
 load 1415667.html
+load 1585851.html
 
 # last_test_to_unload_testsuite.xhtml MUST be the last test in the list because it
 # is responsible for shutting down accessibility service affecting later tests.