With Chromevox or Select-to-Speak on, chrome://settings page crash in flat_tree_traversal.cc's AssertPrecondition.

The pages load OK without these a11y features enabled.


I1127 18:13:29.617715       2 tts_service.cc:298] Done: chrome vox spoken feedback is ready
[1:1:1127/101330.098896:FATAL:flat_tree_traversal.h(147)] Check failed: !node.NeedsDistributionRecalc(). 
#0 0x7f0a48b36b5f base::debug::StackTrace::StackTrace()
#1 0x7f0a48a6643b logging::LogMessage::~LogMessage()
#2 0x7f0a3def671a blink::FlatTreeTraversal::AssertPrecondition()
#3 0x7f0a3dfe2c4c blink::LayoutTreeBuilderTraversal::Parent()
#4 0x7f0a3bf1fd5d blink::AXNodeObject::ComputeParentIfExists()
#5 0x7f0a3bf20eaa blink::AXNodeObject::ChildrenChanged()
#6 0x7f0a3bf002c3 blink::AXLayoutObject::TextChanged()
#7 0x7f0a3bf40a98 blink::AXObjectCacheImpl::TextChanged()
#8 0x7f0a3e6dd32c blink::LayoutText::SetText()
#9 0x7f0a3e6dc944 blink::LayoutText::SetTextWithOffset()
#10 0x7f0a3e040d55 blink::Text::UpdateTextLayoutObject()
#11 0x7f0a3df333e8 blink::CharacterData::SetDataAndUpdate()
#12 0x7f0a3df3411f blink::CharacterData::setNodeValue()
#13 0x7f0a3dffcf2c blink::Node::setTextContent()
#14 0x7f0a3ebf8f52 blink::V8Node::TextContentAttributeSetterCallback()
#15 0x7f0a3fc1aa19 v8::internal::FunctionCallbackArguments::Call()
#16 0x7f0a3fc1944d v8::internal::(anonymous namespace)::HandleApiCallHelper<>()
#17 0x7f0a3fc1848b v8::internal::Builtins::InvokeApiFunction()
#18 0x7f0a401f7651 v8::internal::Object::SetPropertyWithAccessor()
#19 0x7f0a4020e8e2 v8::internal::Object::SetPropertyInternal()
#20 0x7f0a4020e5b8 v8::internal::Object::SetProperty()
#21 0x7f0a403d2475 v8::internal::Runtime::SetObjectProperty()
#22 0x7f0a403d78f0 v8::internal::__RT_impl_Runtime_SetKeyedProperty()
#23 0x7f0a3f9175b2 <unknown>

Received signal 6
#0 0x7f0a48b36b5f base::debug::StackTrace::StackTrace()
#1 0x7f0a48b36661 base::debug::(anonymous namespace)::StackDumpSignalHandler()
#2 0x7f0a3ae340c0 <unknown>
#3 0x7f0a3956cfcf gsignal
#4 0x7f0a3956e3fa abort
#5 0x7f0a48b354d5 base::debug::BreakDebugger()
#6 0x7f0a48a66817 logging::LogMessage::~LogMessage()
#7 0x7f0a3def671a blink::FlatTreeTraversal::AssertPrecondition()
#8 0x7f0a3dfe2c4c blink::LayoutTreeBuilderTraversal::Parent()
#9 0x7f0a3bf1fd5d blink::AXNodeObject::ComputeParentIfExists()
#10 0x7f0a3bf20eaa blink::AXNodeObject::ChildrenChanged()
#11 0x7f0a3bf002c3 blink::AXLayoutObject::TextChanged()
#12 0x7f0a3bf40a98 blink::AXObjectCacheImpl::TextChanged()
#13 0x7f0a3e6dd32c blink::LayoutText::SetText()
#14 0x7f0a3e6dc944 blink::LayoutText::SetTextWithOffset()
#15 0x7f0a3e040d55 blink::Text::UpdateTextLayoutObject()
#16 0x7f0a3df333e8 blink::CharacterData::SetDataAndUpdate()
#17 0x7f0a3df3411f blink::CharacterData::setNodeValue()
#18 0x7f0a3dffcf2c blink::Node::setTextContent()
#19 0x7f0a3ebf8f52 blink::V8Node::TextContentAttributeSetterCallback()
#20 0x7f0a3fc1aa19 v8::internal::FunctionCallbackArguments::Call()
#21 0x7f0a3fc1944d v8::internal::(anonymous namespace)::HandleApiCallHelper<>()
#22 0x7f0a3fc1848b v8::internal::Builtins::InvokeApiFunction()
#23 0x7f0a401f7651 v8::internal::Object::SetPropertyWithAccessor()
#24 0x7f0a4020e8e2 v8::internal::Object::SetPropertyInternal()
#25 0x7f0a4020e5b8 v8::internal::Object::SetProperty()
#26 0x7f0a403d2475 v8::internal::Runtime::SetObjectProperty()
#27 0x7f0a403d78f0 v8::internal::__RT_impl_Runtime_SetKeyedProperty()
#28 0x7f0a3f9175b2 <unknown>
  r8: 0000000000000000  r9: 00007ffcbf5f9420 r10: 0000000000000008 r11: 0000000000000246
 r12: 00007ffcbf5f9ef8 r13: 00007ffcbf5f9ee8 r14: 00007ffcbf5f9ef0 r15: 00007ffcbf5f9e91
  di: 0000000000000002  si: 00007ffcbf5f9420  bp: 00007ffcbf5f9660  bx: 0000000000000006
  dx: 0000000000000000  ax: 0000000000000000  cx: 00007f0a3956cfcf  sp: 00007ffcbf5f9498
  ip: 00007f0a3956cfcf efl: 0000000000000246 cgf: 002b000000000033 erf: 0000000000000000
 trp: 0000000000000000 msk: 0000000000000000 cr2: 0000000000000000
[end of stack trace]
Calling _exit(1). Core file will not be generated.


I tried reverting a few of Alice's recent commits at Dominic's suggestion, as they seem to be related. These did not fix the bug:
git revert -c a8991e6176684e4b70cf8819cfe1300993ab337a
git revert -c e930a44114a7f687fe434483f1754d07b99d3337
git revert -c 3681121fd387b017483102bfc3b17b8547bdd6fc
git revert -c 31ad4379452829c09f2cc4f79bdf8e9897bc30dc

Reverting this one did fix the crash:
git revert -c e7316d0c2c1a3ea146197778d926502c9646e4bf

So I think it must be introduced by that patch set. Assigning to aboxhall to investigate.