"We must reach document accessible implementing text interface!" assertion in SelectionManager::ProcessSelectionChanged when direct child of shadow root gets focus

RESOLVED FIXED in Firefox 68

Status

()

defect
P2
normal
RESOLVED FIXED
5 months ago
4 months ago

People

(Reporter: Jamie, Assigned: Jamie)

Tracking

unspecified
mozilla68
Points:
---
Dependency tree / graph

Firefox Tracking Flags

(firefox68 fixed)

Details

Attachments

(1 attachment)

We hit the "We must reach document accessible implementing text interface!" assertion in SelectionManager::ProcessSelectionChanged whenever something in shadow DOM gets focused:
https://searchfox.org/mozilla-central/source/accessible/base/SelectionManager.cpp#188

STR:

  1. Open this test case:
    data:text/html,<div id="host"></div><script>let shadow = host.attachShadow({mode: "open"}); shadow.innerHTML = '<button>test</button>';</script>
  2. Tab to the button.

Still trying to work out what's going on here. So far, I know the following:

  1. The call to SelectionManager::ProcessSelectionChanged is triggered by DOM focus.
  2. We get the common ancestor for the range (cntrNode), which is a document fragment (nodeName #document-fragment). Presumably, this is the shadow DOM's fragment. It has no parent node.
  3. We call nsAccUtils::GetTextContainer, which calls DocAccessible::GetAccessibleOrContainer.
  4. That calls GetFlattenedTreeParent() on the node from step 2, which returns null.

Actually, this only happens if a direct child of the shadow root gets focus, since that's when the common ancestor will be the shadow root document fragment. I have a fix; taking.

Assignee: nobody → jteh
Summary: "We must reach document accessible implementing text interface!" assertion in SelectionManager::ProcessSelectionChanged whenever something in shadow DOM gets focus → "We must reach document accessible implementing text interface!" assertion in SelectionManager::ProcessSelectionChanged when direct child of shadow root gets focus

This can happen, for example, when GetAccessibleOrContainer is called within SelectionManager::ProcessSelectionChanged due to focusing a direct child of a shadow root.
In this case, the common ancestor is the shadow root itself.
Previously, we returned null in this case because GetFlattenedTreeParent doesn't work on the shadow root itself.
Now, we check if the given node is the shadow root, and if so, we use the shadow host instead.

Pushed by jteh@mozilla.com:
https://hg.mozilla.org/integration/autoland/rev/faa43bdd3347
Correctly handle retrieving a container accessible for a shadow root. r=eeejay
Pushed by jteh@mozilla.com:
https://hg.mozilla.org/integration/autoland/rev/1b6bf9395372
Correctly handle retrieving a container accessible for a shadow root. r=eeejay
Status: NEW → RESOLVED
Closed: 4 months ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla68
Flags: needinfo?(jteh)
https://hg.mozilla.org/projects/ash/rev/1b6bf93953727decb8481cb58937ec3eefa5821a
Bug 1530931: Correctly handle retrieving a container accessible for a shadow root. r=eeejay
You need to log in before you can comment on or make changes to this bug.