1538991 - Crash in [@ mozilla::a11y::NotificationController::CoalesceMutationEvents]

Status: VERIFIED FIXED

(Core :: Disability Access APIs, defect, P3)

Description

[:Gijs (he/him)]

This bug is for crash report bp-b4cc9529-73fa-472b-b4f0-295ae0190325.

Top 8 frames of crashing thread:

0 libmozglue.dylib MOZ_Crash mfbt/Assertions.h:314
1 libmozglue.dylib MOZ_CrashPrintf mfbt/Assertions.cpp:55
2 XUL mozilla::a11y::NotificationController::CoalesceMutationEvents accessible/base/AccEvent.h:587
3 XUL PLDHashTable::Search const xpcom/ds/PLDHashTable.cpp:351
4 XUL mozilla::a11y::Accessible::InsertChildAt accessible/generic/Accessible.cpp:2078
5 XUL mozilla::a11y::AccessibleWrap::InsertChildAt accessible/mac/AccessibleWrap.mm:119
6 XUL mozilla::a11y::DocAccessible::MoveChild accessible/generic/DocAccessible.cpp:2130
7 XUL mozilla::a11y::DocAccessible::CacheChildrenInSubtree accessible/generic/DocAccessible.cpp:2158

Hit when using spacebar to activate the button that "lets you in" to about:config, on beta 67. Not sure if that's where the crash came from or if that's an accident.

Comment 1

[Ryan VanderMeulen [:RyanVM]]

Morgan, this is spiking in the 88.0rc1 build. Bug 1699053 was the only change to a11y code in that release, and looking at the Nightly reports, I see a similar jump in reports after it landed there as well. Can you please take a look?

Comment 2

[Morgan Reschenberg [:morgan]]

yep will check this out today, thanks 😀

Comment 3

[Morgan Reschenberg [:morgan]]

Attachment: Bug 1538991: Verify parent exists before calling ReorderEventTarget r?eeejay

Comment 4

[Morgan Reschenberg [:morgan]]

Comment on attachment 9216120 [details]
Bug 1538991: Verify parent exists before calling ReorderEventTarget r?eeejay

Beta/Release Uplift Approval Request

• User impact if declined: Users may continue to experience this crash.
• Is this code covered by automated tests?: Unknown
• Has the fix been verified in Nightly?: No
• Needs manual test from QE?: Yes
• If yes, steps to reproduce: Some users report this crash happening when they navigate to about:config for the first time (and click the 'accept and continue') button. Most of these crashes are on windows, but from our testing it doesn't seem to be something that happens consistently, so I'm not sure if QA will be able to verify.
• List of other uplifts needed: None
• Risk to taking this patch: Low
• Why is the change risky/not risky? (and alternatives if risky): This code adds a null check, which we arguably should've been doing already. It may be covered by our automatic testing -- we haven't had any failures, but it also may be an intermittent we haven't seen, so its hard to tell. Because this crash isn't consistently reproducible, its possible this patch doesn't actually fix the problem completely, but nevertheless it won't break anything further.
• String changes made/needed:

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/c9e1a934ff12
Verify parent exists  before calling ReorderEventTarget r=eeejay

Comment 6

[Morgan Reschenberg [:morgan]]

To add to that risk assessment above: if you filter the crash by "accessibility in process", it looks like this doesn't affect NVDA or Jaws, our primary AT targets on windows (https://searchfox.org/mozilla-central/source/accessible/windows/msaa/Compatibility.h#98) They seem to affect users on Vispero Shared, Kazaguru, and "unknown" a11y technologies. You can see how those populations compare to our total AT usage here: https://sql.telemetry.mozilla.org/dashboard/platform-accessibility

Comment 7

[Ryan VanderMeulen [:RyanVM]]

Comment on attachment 9216120 [details]
Bug 1538991: Verify parent exists before calling ReorderEventTarget r?eeejay

Thanks, let's try taking this fix instead of backing out then. Approved for 88.0rc2.

Comment 8

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-release/rev/8fe773efa8db

Comment 9

[Natalia Csoregi [:nataliaCs]]

https://hg.mozilla.org/mozilla-central/rev/c9e1a934ff12

Comment 10

[Bogdan Maris, Desktop QA]

(In reply to Morgan Reschenberg [:morgan] from comment #6)

They seem to affect users on Vispero Shared, Kazaguru, and "unknown" a11y technologies.

Unfortunately I could not find the software to install in order to reproduce/verify this issue. Do you know a place where I could download and install the software affected by this crash to give it a try?

Comment 11

[Ryan VanderMeulen [:RyanVM]]

No crash reports from the rc2 build so far anyway :)

Comment 12

[Ryan VanderMeulen [:RyanVM]]

I think we can call this verified by way of crash-stats.