Open Bug 1573292 Opened 3 years ago Updated 2 months ago

Fix usage of nsIDocShellTreeItem in nsAccessibilityService::GetRootDocumentAccessible


(Core :: Disability Access APIs, enhancement, P2)




Fission Milestone Future


(Reporter: djvj, Unassigned)


(Blocks 2 open bugs)


(Whiteboard: [rm-docshell-tree-item:simple])

In accessible/base/nsAccessibilityService.cpp, in GetRootDocumentAccessible (

The logic uses GetInProcessRootTreeItem to obtain the root and check if it is the same as the current tree item. If it is not the same (current item is not the root), then the presShell variable is replaced with the PresShell of the current document.

However, in a post-fission world, it can occur such that the "in-process root" is the same as the current item, but the actual root is out of process. In this case, we would erroneously skip this assignment, and use the presShell provided in the argument.

The fix here seems like it should be the following:

  1. Use GetInProcessParent to obtain the parent.
  2. If it's null, then the current item is either the true root, or it is the child of an out-of-process item.
  3. In the case that it is null, use BrowsingContext to obtain information about whether there exists an out-of-process parent.
  4. If an out-of-process parent exists, then this item cannot be the true root.
  5. If the OOP parent does not exist, then this item is the true root.
  6. Adjust conditional logic accordingly.
Component: DOM: Core & HTML → Disability Access APIs
Fission Milestone: --- → M5
Priority: -- → P2

Updated with fixed-location link:

Now that I understand things better, the fix for this can be described much more simply: adjust the is this the root item check to use the BrowsingContext instead of nsIDocShellTreeItem.

Whiteboard: [rm-docshell-tree-item:simple]
Fission Milestone: M5 → Future

Kannan says replacing nsIDocShellTreeItem calls should block enabling Fission in Nightly (M6).

Fission Milestone: Future → M6
Blocks: a11y-fission

This is only ever used in the parent process by code which hooks up Gecko accessibility to the OS (widget code + Android SessionAccessibility). In any case, as far as the a11y engine is concerned, root accessible means in-process root accessible (the outer most accessible in the in-process a11y tree). Therefore, we don't want to change the behaviour here.

Fission Milestone: M6 → Future
Severity: normal → S3
You need to log in before you can comment on or make changes to this bug.