Closed Bug 1568163 Opened 1 year ago Closed 1 year ago

Firefox crashes when using the Accessibility Inspector on the browser mozilla::a11y::HyperTextAccessible::NativeRole]

Categories

(Core :: Disability Access APIs, defect, P1, critical)

Desktop
Windows
defect

Tracking

()

VERIFIED FIXED
mozilla70
Tracking Status
firefox-esr60 --- wontfix
firefox-esr68 --- wontfix
firefox68 --- wontfix
firefox69 --- verified
firefox70 --- verified

People

(Reporter: atrif, Assigned: Jamie)

Details

(Keywords: crash, regressionwindow-wanted)

Crash Data

Attachments

(2 files)

Attached image crash_tools.gif

Affected versions

  • Firefox 70.0a1 (20190722214346)
  • Firefox 69.0b7 (20190722201635)

Affected platforms

  • Windows 10x64

Steps to reproduce

  1. Launch Firefox with a new profile and open Browser Tools (Ctrl+ Shift+ C).
  2. Enable browser toolbox.
  3. Open the browser toolbox.
  4. Select Accessibility in the toolbar and the Accessibility Inspector.
  5. Continuously move the pointer over Browser Tools (Inspector, Console, Debugger, etc.).

Expected result

  • Firefox doesn't crash.

Actual result

Additional Notes

  • Cannot search for regression range due to bug 1564542.
  • I cannot reproduce the issue on macOS 10.14 or Ubuntu 18.04.
  • Note that the issue may be intermittent.
  • Attached a screen recording with the issue.
Has Regression Range: --- → no
Has STR: --- → yes
Assignee: nobody → jteh
OS: Windows 10 → Windows
Priority: -- → P1

On Windows, OuterDocAccessible::GetChildAt can return a proxy wrapper for a remote document.
These aren't real Accessibles and shouldn't be returned except to the Windows a11y code (which doesn't use eDeepestChild).
Calling ChildAtPoint on these will crash!
Therefore, just return null in this case.

Alexandru, is there any chance you might be able to test this with the following try build:
https://treeherder.mozilla.org/#/jobs?repo=try&revision=e457854c6f26079fbd8d6e3b08808987bf0aaf7a
I'm a blind screen reader user, so I can't use a mouse effectively, which makes it impossible for me to test this. However, I believe I've fixed the bug in this build. Thanks!

Flags: needinfo?(alexandru.trif)

Hello James,
I tested with the provided build on Windows 10x64 following the steps from comment 0 moving the mouse pointer several times across browser and browser tools and no crashes were encountered while doing that. I even created new profiles and retested again and I cannot reproduce the crash anymore. If there is anything I can help with please let me know. Thank you!

Flags: needinfo?(alexandru.trif)
Pushed by jteh@mozilla.com:
https://hg.mozilla.org/integration/autoland/rev/3f39ed95662a
Don't return proxy wrappers from OuterDocAccessible::ChildAtPoint with eDeepestChild to prevent crashes when hit testing via XPCOM. r=yzen
Status: NEW → RESOLVED
Closed: 1 year ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla70

Hello!
The issue is verified fixed on Windows 10x64 with Firefox 70.0a1 (20190725215157). No crashes occur while doing the steps from comment 0.

Status: RESOLVED → VERIFIED

Comment on attachment 9080236 [details]
Bug 1568163: Don't return proxy wrappers from OuterDocAccessible::ChildAtPoint with eDeepestChild to prevent crashes when hit testing via XPCOM.

Beta/Release Uplift Approval Request

  • User impact if declined: Crashes on Windows when moving the mouse over the browser after enabling the Accessibility Inspector in the Browser Toolbox.
  • Is this code covered by automated tests?: No
  • Has the fix been verified in Nightly?: Yes
  • Needs manual test from QE?: Yes
  • If yes, steps to reproduce: See comment 0.
  • List of other uplifts needed: None
  • Risk to taking this patch: Low
  • Why is the change risky/not risky? (and alternatives if risky): Trivial fix which affects a very specific code path only engaged (outside of tests) when using the Accessibility Inspector in the Browser Toolbox on Windows.
  • String changes made/needed: None.
Attachment #9080236 - Flags: approval-mozilla-beta?
Flags: qe-verify+
QA Whiteboard: [qa-triaged]

Comment on attachment 9080236 [details]
Bug 1568163: Don't return proxy wrappers from OuterDocAccessible::ChildAtPoint with eDeepestChild to prevent crashes when hit testing via XPCOM.

Fixes a crash with the Accessibility Inspector. Approved for 69.0b9.

Attachment #9080236 - Flags: approval-mozilla-beta? → approval-mozilla-beta+

Hello,
The issue is verified fixed using Firefox 69.0b9 (20190726195447) on Windows 10x64. Thank you!

Flags: qe-verify+
You need to log in before you can comment on or make changes to this bug.