1657193 - Crash in [@ mozilla::a11y::GeckoTextMarkerRange::TextInternal]

Status: RESOLVED FIXED

(Core :: Disability Access APIs, defect, P1)

Description

[Eitan Isaacson [:eeejay]]

It looks like we have an issue where the a11y tree can mutate in the content process while we are constructing a string from that subtree in the parent process.

I think in that case we should just bail early since the parent tree at that point has lost all integrity.

More generally, constructing strings from subtrees in the parent process is proving to be very expensive and error prone as this shows since it is not blocking the DOM thread.

Comment 1

[Eitan Isaacson [:eeejay]]

Attachment: Bug 1657193 - Bail early if we detect tree corruption when building a string. r?morgan

Comment 2

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/b4ab50ce0b20
Bail early if we detect tree corruption when building a string. r=morgan

Comment 3

[Bogdan Tara[:bogdan_tara | bogdant]]

https://hg.mozilla.org/mozilla-central/rev/b4ab50ce0b20

Comment 4

[Julien Cristau [:jcristau]]

Please request beta uplift when you get a chance.

Comment 5

[Eitan Isaacson [:eeejay]]

Comment on attachment 9167978 [details]
Bug 1657193 - Bail early if we detect tree corruption when building a string. r?morgan

Beta/Release Uplift Approval Request

• User impact if declined: Crash potential
• Is this code covered by automated tests?: Yes
• Has the fix been verified in Nightly?: Yes
• Needs manual test from QE?: No
• If yes, steps to reproduce:
• List of other uplifts needed: None
• Risk to taking this patch: Low
• Why is the change risky/not risky? (and alternatives if risky): This is a small change
• String changes made/needed:

Comment 6

[Julien Cristau [:jcristau]]

Comment on attachment 9167978 [details]
Bug 1657193 - Bail early if we detect tree corruption when building a string. r?morgan

macos a11y crash fix, for 80.0b5

Comment 7

[Julien Cristau [:jcristau]]

https://hg.mozilla.org/releases/mozilla-beta/rev/fac5db6006eb