Chrome 56.0.2910.0
OSX 10.12.1

What steps will reproduce the problem?
(1) Run Chrome with DCHECKs enabled.
(2) Turn on VoiceOver
(3) Visit chrome://settings

What is the expected result?
chrome://settings loads

What happens instead?
Crash:

[97880:775:1111/132114:FATAL:FlatTreeTraversal.h(127)] Check failed: !node.needsDistributionRecalc().
0   libbase.dylib                       0x0000000110cc0e63 _ZN4base5debug10StackTraceC1Ev + 19
1   libbase.dylib                       0x0000000110ce81a7 _ZN7logging10LogMessageD2Ev + 71
2   libblink_core.dylib                 0x000000011af85d4a _ZN5blink17FlatTreeTraversal18assertPreconditionERKNS_4NodeE + 90
3   libblink_core.dylib                 0x000000011b11577c _ZN5blink26LayoutTreeBuilderTraversal6parentERKNS_4NodeEPNS0_13ParentDetailsE + 156
4   libblink_core.dylib                 0x000000011b001927 _ZN5blink21ElementResolveContextC2ERNS_7ElementE + 151
5   libblink_core.dylib                 0x000000011b02b34f _ZN5blink13StyleResolver15styleForElementEPNS_7ElementEPKNS_13ComputedStyleENS_20StyleSharingBehaviorENS_20RuleMatchingBehaviorE + 687
6   libblink_modules.dylib              0x000000011e326d4b _ZNK5blink8AXObject37isHiddenForTextAlternativeCalculationEv + 539
7   libblink_modules.dylib              0x000000011e31d418 _ZNK5blink12AXNodeObject20nameFromLabelElementEv + 56
8   libblink_modules.dylib              0x000000011e30f95e _ZNK5blink12AXNodeObject29computeAccessibilityIsIgnoredEPNS_10HeapVectorINS_13IgnoredReasonELm0EEE + 238
9   libblink_modules.dylib              0x000000011e32533a _ZNK5blink8AXObject35updateCachedAttributeValuesIfNeededEv + 282
10  libblink_modules.dylib              0x000000011e32520e _ZNK5blink8AXObject22accessibilityIsIgnoredEv + 14
11  libblink_modules.dylib              0x000000011e330e9c _ZN5blink17AXObjectCacheImpl11getOrCreateEPNS_4NodeE + 860
12  libblink_modules.dylib              0x000000011e31db21 _ZNK5blink12AXNodeObject13computeParentEv + 209
13  libblink_modules.dylib              0x000000011e3260db _ZNK5blink8AXObject14ariaHiddenRootEv + 283
14  libblink_modules.dylib              0x000000011e3254c7 _ZNK5blink8AXObject26computeIsInertOrAriaHiddenEPNS_10HeapVectorINS_13IgnoredReasonELm0EEE + 183
15  libblink_modules.dylib              0x000000011e325270 _ZNK5blink8AXObject35updateCachedAttributeValuesIfNeededEv + 80
16  libblink_modules.dylib              0x000000011e32520e _ZNK5blink8AXObject22accessibilityIsIgnoredEv + 14
17  libblink_modules.dylib              0x000000011e330e9c _ZN5blink17AXObjectCacheImpl11getOrCreateEPNS_4NodeE + 860
18  libblink_modules.dylib              0x000000011e31db21 _ZNK5blink12AXNodeObject13computeParentEv + 209
19  libblink_modules.dylib              0x000000011e3260db _ZNK5blink8AXObject14ariaHiddenRootEv + 283
20  libblink_modules.dylib              0x000000011e3254c7 _ZNK5blink8AXObject26computeIsInertOrAriaHiddenEPNS_10HeapVectorINS_13IgnoredReasonELm0EEE + 183
21  libblink_modules.dylib              0x000000011e325270 _ZNK5blink8AXObject35updateCachedAttributeValuesIfNeededEv + 80
22  libblink_modules.dylib              0x000000011e32520e _ZNK5blink8AXObject22accessibilityIsIgnoredEv + 14
23  libblink_modules.dylib              0x000000011e330e9c _ZN5blink17AXObjectCacheImpl11getOrCreateEPNS_4NodeE + 860
24  libblink_modules.dylib              0x000000011e335127 _ZN5blink17AXObjectCacheImpl22handleAttributeChangedERKNS_13QualifiedNameEPNS_7ElementE + 343
25  libblink_core.dylib                 0x000000011b0d7c66 _ZN5blink7Element16attributeChangedERKNS_13QualifiedNameERKN3WTF12AtomicStringES7_NS0_27AttributeModificationReasonE + 1126
26  libblink_core.dylib                 0x000000011b0de659 _ZN5blink7Element15didAddAttributeERKNS_13QualifiedNameERKN3WTF12AtomicStringE + 105
27  libblink_core.dylib                 0x000000011b0de51c _ZN5blink7Element23appendAttributeInternalERKNS_13QualifiedNameERKN3WTF12AtomicStringENS0_30SynchronizationOfLazyAttributeE + 364
28  libblink_core.dylib                 0x000000011b0d7309 _ZN5blink7Element12setAttributeERKN3WTF12AtomicStringES4_RNS_14ExceptionStateE + 697
29  libblink_core.dylib                 0x000000011bc1d3d3 _ZN5blink17ElementV8Internal26setAttributeMethodCallbackERKN2v820FunctionCallbackInfoINS1_5ValueEEE + 563
30  libv8.dylib                         0x000000010f8b7529 _ZN2v88internal25FunctionCallbackArguments4CallEPFvRKNS_20FunctionCallbackInfoINS_5ValueEEEE + 409
31  libv8.dylib                         0x000000010f984e05 _ZN2v88internal12_GLOBAL__N_119HandleApiCallHelperILb0EEENS0_11MaybeHandleINS0_6ObjectEEEPNS0_7IsolateENS0_6HandleINS0_10HeapObjectEEESA_NS8_INS0_20FunctionTemplateInfoEEENS8_IS4_EENS0_16BuiltinArgumentsE + 1013
32  libv8.dylib                         0x000000010f983b5a _ZN2v88internalL26Builtin_Impl_HandleApiCallENS0_16BuiltinArgumentsEPNS0_7IsolateE + 330
33  libv8.dylib                         0x000000010f9837ed _ZN2v88internal21Builtin_HandleApiCallEiPPNS0_6ObjectEPNS0_7IsolateE + 221
34  ???                                 0x00001b94d62843a7 0x0 + 30326062072743


The stacktrace seems to do with ariaHiddenRoot.
dmazzoni@, could you triage?
 

Deleted: chrome-settings-VoiceOver-crash.mov 28.8 MB

chrome-settings-VoiceOver-crash.mov 28.8 MB Download