1558369 - Fission a11y: OOP iframes not accessible in-process with COM handler enabled

Status: RESOLVED FIXED

(Core :: Disability Access APIs, defect, P1)

Description

[James Teh [:Jamie]]

When the accessibility COM handler is enabled, in-process clients can't access OOP iframes. For example, NVDA fails to render them in its buffer. This works as expected when the handler is disabled.

My guess is that this relates to IGeckoBackChannel::get_AllChildren and HandlerEnumerator. The embedder only has an IDispatch COM proxy for the embedded document, but get_AllChildren tries to QI this to IAccessible2_3. That's probably going to fail because of the sandbox.

Comment 1

[James Teh [:Jamie]]

Attachment: Bug 1558369: AccessibleHandler: Don't use HandlerChildEnumerator for iframes.

When a client wants to fetch all accessible children, the COM handler uses handlerProvider::get_AllChildren in the content process to optimize cross-process retrieval of all children.
This works fine for iframes rendered in the same content process, just as it does for other accessibles.
However, for out-of-process iframes, HandlerProvider::get_AllChildren will fail.
This is because we only send down an IDispatch COM proxy for the embedded document, but get_AllChildren will try to QueryInterface this to IAccessible2 to reduce QI calls from the parent process.
Because the content process is sandboxed, it can't make the outgoing COM call to QI the proxy from IDispatch to IAccessible2 and so it fails.

Since an iframe only has one child anyway, we don't need the bulk fetch optimization offered by HandlerChildEnumerator or even IEnumVARIANT.
Therefore, we explicitly tell the client this interface is not supported, which will cause the oleacc AccessibleChildren function to fall back to accChild.

Comment 2

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/d8c452255338
AccessibleHandler: Don't use HandlerChildEnumerator for iframes. r=yzen

Comment 3

[Oana Pop-Rus]

https://hg.mozilla.org/mozilla-central/rev/d8c452255338

Comment 4

[Chris Peterson [:cpeterson]]

Retroactively moving fixed bugs whose summaries mention "Fission" (or other Fission-related keywords) but are not assigned to a Fission Milestone to an appropriate Fission Milestone.

This will generate a lot of bugmail, so you can filter your bugmail for the following UUID and delete them en masse:

0ee3c76a-bc79-4eb2-8d12-05dc0b68e732