Closed Bug 1545190 Opened 4 months ago Closed 4 months ago

Crash [@ nsAccessibilityService::CreateAccessibleByFrameType] with shadow DOM enabled

Categories

(Core :: Disability Access APIs, defect)

66 Branch
defect
Not set

Tracking

()

RESOLVED FIXED
mozilla68
Tracking Status
firefox-esr60 --- unaffected
firefox66 --- wontfix
firefox67 --- fixed
firefox68 --- fixed

People

(Reporter: agashlin, Assigned: eeejay)

References

Details

(Keywords: crash, testcase)

Crash Data

Attachments

(2 files)

I'm getting a consistent content process crash on Nightly with the new Chromium issue detail interface (which I think went live yesterday according to this announcement), see for instance: https://bugs.chromium.org/p/chromium/issues/detail?id=839614

mozregression gave:
Last good revision: 48a5d87cf9bdb59e39653ab331df04ea2a04267d
First bad revision: 20d536fd0f2a02bd4527044d367cf98bebbb358d
Pushlog:
https://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=48a5d87cf9bdb59e39653ab331df04ea2a04267d&tochange=20d536fd0f2a02bd4527044d367cf98bebbb358d

which points to when shadow DOM was enabled. If I go back to 2018-05-31 and turn off dom.webcomponents.shadowdom.enabled the issue doesn't reproduce. This pref doesn't seem to work anymore if I turn it on in current Nightly.

Bug 1404431 has the same signature but I don't know if it's directly related.

Crash reports:
https://crash-stats.mozilla.org/report/index/ed4132a1-1586-4a27-9645-d2f9f0190417
https://crash-stats.mozilla.org/report/index/349bf5cf-2140-46c3-a8c1-04c0e0190417
https://crash-stats.mozilla.org/report/index/297ee5d6-79f9-4d61-8334-8a2c70190417
https://crash-stats.mozilla.org/report/index/b8b3b235-46dd-47a0-8d8b-ca3ed0190417

Summary: Crash in nsAccessibilityService::CreateAccessibleByFrameType with shadow DOM enabled → Crash [@ nsAccessibilityService::CreateAccessibleByFrameType ] with shadow DOM enabled
See Also: → 1404431
Summary: Crash [@ nsAccessibilityService::CreateAccessibleByFrameType ] with shadow DOM enabled → Crash [@ nsAccessibilityService::CreateAccessibleByFrameType] with shadow DOM enabled
Crash Signature: [@ nsAccessibilityService::CreateAccessibleByFrameType ]
Assignee: nobody → eitan
Flags: in-testsuite?
Keywords: crash, testcase

Note that the test case in comment 2 is for display: contents, not shadow DOM. (The original issue was related to shadow DOM.) I think the patch in comment 1 might handle both because of the additional null checks, but I'm not certain.

Pushed by eisaacson@mozilla.com:
https://hg.mozilla.org/integration/autoland/rev/a9d788547dfa
Allow table in host and row in shadow. r=Jamie

I have a 100% reproducibility with this page: https://bugs.chromium.org/p/chromium/issues/detail?id=954115

here is a crash report:

I also notice that for the past two days, I have blank entry in my menus.

(In reply to Bill Goldstein [:aja] (UTC-5) from comment #4)

FYI, I can hit perhaps same issue (with win64 nightly) by visiting: https://bugs.chromium.org/p/chromium/issues/detail?id=946176
resulting in crash reports, e.g.
https://crash-stats.mozilla.org/report/index/04a2ecd2-70f9-4088-a791-81bb00190418
https://crash-stats.mozilla.org/report/index/de5ef8be-9f76-40f8-9999-b2a4f0190418

This page now works fine for me with an autoland build containing patch in comment 5.

Status: NEW → RESOLVED
Closed: 4 months ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla68

Is this something we should consider for Beta uplift?

Flags: needinfo?(eitan)
Flags: in-testsuite?
Flags: in-testsuite+

(In reply to Ryan VanderMeulen [:RyanVM] from comment #9)

Is this something we should consider for Beta uplift?

Yes, I think so. Apparently this could be reproduced in release as well according to bug 1404431 with no shadow dom enabled.

Flags: needinfo?(eitan)

Comment on attachment 9059138 [details]
Bug 1545190 - Allow table in host and row in shadow. r?Jamie!

Beta/Release Uplift Approval Request

  • User impact if declined: Potential crashes
  • Is this code covered by automated tests?: Yes
  • Has the fix been verified in Nightly?: Yes
  • Needs manual test from QE?: No
  • If yes, steps to reproduce:
  • List of other uplifts needed: None
  • Risk to taking this patch: Low
  • Why is the change risky/not risky? (and alternatives if risky): There is a test in place, and it is mostly just null checks.
  • String changes made/needed:
Attachment #9059138 - Flags: approval-mozilla-beta?

Comment on attachment 9059138 [details]
Bug 1545190 - Allow table in host and row in shadow. r?Jamie!

Low risk patch with tests that should fix some crashes on beta, uplift approved for 67 beta 14, thanks.

Attachment #9059138 - Flags: approval-mozilla-beta? → approval-mozilla-beta+
Duplicate of this bug: 1404431
You need to log in before you can comment on or make changes to this bug.