1645067 - Crash in [@ mozilla::a11y::DocAccessibleChild::GetNativeWindowHandle]

Status: VERIFIED FIXED

(Core :: Disability Access APIs, defect, P1)

Description

[Ryan VanderMeulen [:RyanVM]]

This bug is for crash report bp-a87a0edb-4014-4420-ae5c-e64150200611.

This first regressed in the 20200610214041 build. Pushlog range:
https://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=b2df79a80c03&tochange=fab7c4f54054ceb06504c7ddac380858e2521fc4

Top 10 frames of crashing thread:

0 xul.dll mozilla::a11y::DocAccessibleChild::GetNativeWindowHandle const accessible/ipc/win/DocAccessibleChild.cpp:94
1 xul.dll static mozilla::a11y::AccessibleWrap::GetHWNDFor accessible/windows/msaa/AccessibleWrap.cpp:1280
2 xul.dll mozilla::a11y::ia2Accessible::get_windowHandle accessible/windows/ia2/ia2Accessible.cpp:354
3 xul.dll mozilla::a11y::HandlerProvider::BuildDynamicIA2Data accessible/ipc/win/HandlerProvider.cpp:316
4 xul.dll mozilla::detail::RunnableMethodImpl<mozilla::a11y::HandlerProvider*, void  xpcom/threads/nsThreadUtils.h:1237
5 xul.dll static mozilla::mscom::MainThreadInvoker::MainThreadAPC ipc/mscom/MainThreadInvoker.cpp:172
6 ntdll.dll RtlDispatchAPC 
7 ntdll.dll KiUserApcDispatch 
8 ntdll.dll NtWaitForSingleObject 
9 kernelbase.dll kernelbase.dll@0x226ed 

Comment 1

[Ryan VanderMeulen [:RyanVM]]

Jamie, I see a few possibly-related changes landed by you in that pushlog range. Maybe bug 1644319?

Comment 2

[Marco Zehe (:MarcoZ)]

Interesting, the client that instantiated accessibility is called Unchecky and is not an officially supported client. Not sure if it is related, but thought it worth noting that it, in this case, is not JAWS, the only known consumer of window emulation, that instantiated it.

Comment 3

[James Teh [:Jamie]]

I don't understand why this is crashing yet, but I don't think window emulation is actually enabled. It seems to be crashing when we check whether there is an emulated window handle... but I added a null check to deal with this precise case, so I'm not sure why that isn't working.

Comment 4

[James Teh [:Jamie]]

Attachment: Bug 1645067: Set the top level DocAccessibleChild as early as possible.

Otherwise, if we're replacing a previous top level doc, we might refer to the old top level doc during initialization.

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/d08313ba26df
Set the top level DocAccessibleChild as early as possible. r=MarcoZ

Comment 6

[Natalia Csoregi [:nataliaCs]]

https://hg.mozilla.org/mozilla-central/rev/d08313ba26df