Closed
Bug 1657193
Opened 4 years ago
Closed 4 years ago
Crash in [@ mozilla::a11y::GeckoTextMarkerRange::TextInternal]
Categories
(Core :: Disability Access APIs, defect, P1)
Tracking
()
RESOLVED
FIXED
81 Branch
| Tracking | Status | |
|---|---|---|
| firefox-esr68 | --- | unaffected |
| firefox-esr78 | --- | unaffected |
| firefox79 | --- | unaffected |
| firefox80 | + | fixed |
| firefox81 | --- | fixed |
People
(Reporter: eeejay, Assigned: eeejay)
References
(Regression)
Details
(Keywords: crash, regression, Whiteboard: [Mac2020_1])
Crash Data
Attachments
(1 file)
|
47 bytes,
text/x-phabricator-request
|
jcristau
:
approval-mozilla-beta+
|
Details | Review |
It looks like we have an issue where the a11y tree can mutate in the content process while we are constructing a string from that subtree in the parent process.
I think in that case we should just bail early since the parent tree at that point has lost all integrity.
More generally, constructing strings from subtrees in the parent process is proving to be very expensive and error prone as this shows since it is not blocking the DOM thread.
|
Assignee | |
Comment 1•4 years ago
|
||
|
||
Updated•4 years ago
|
Assignee: nobody → eitan
Status: NEW → ASSIGNED
|
||
Updated•4 years ago
|
status-firefox79:
--- → unaffected
status-firefox80:
--- → affected
status-firefox81:
--- → affected
status-firefox-esr68:
--- → unaffected
status-firefox-esr78:
--- → unaffected
tracking-firefox80:
--- → +
Pushed by eisaacson@mozilla.com: https://hg.mozilla.org/integration/autoland/rev/b4ab50ce0b20 Bail early if we detect tree corruption when building a string. r=morgan
|
||
Comment 3•4 years ago
|
||
| bugherder | ||
Status: ASSIGNED → RESOLVED
Closed: 4 years ago
Resolution: --- → FIXED
Target Milestone: --- → 81 Branch
|
|
Assignee | |
Comment 5•4 years ago
|
||
Comment on attachment 9167978 [details]
Bug 1657193 - Bail early if we detect tree corruption when building a string. r?morgan
Beta/Release Uplift Approval Request
- User impact if declined: Crash potential
- Is this code covered by automated tests?: Yes
- Has the fix been verified in Nightly?: Yes
- Needs manual test from QE?: No
- If yes, steps to reproduce:
- List of other uplifts needed: None
- Risk to taking this patch: Low
- Why is the change risky/not risky? (and alternatives if risky): This is a small change
- String changes made/needed:
Flags: needinfo?(eitan)
Attachment #9167978 -
Flags: approval-mozilla-beta?
|
|
||
Comment 6•4 years ago
|
||
Comment on attachment 9167978 [details]
Bug 1657193 - Bail early if we detect tree corruption when building a string. r?morgan
macos a11y crash fix, for 80.0b5
Attachment #9167978 -
Flags: approval-mozilla-beta? → approval-mozilla-beta+
|
|
||
Comment 7•4 years ago
|
||
| bugherder uplift | ||
|
||
Updated•4 years ago
|
Has Regression Range: --- → yes
You need to log in
before you can comment on or make changes to this bug.
Description
•