1668695 - Intermittent freezes/stuttering when moving the cursor on Windows 10 with the "text cursor indicator" enabled

Status: RESOLVED FIXED

(Core :: Disability Access APIs, defect)

Description

[Dennis Schubert [:denschub]]

Reproducing this issue requires Windows 10's "text cursor indicator" to be enabled. For that:

1. Go into the Windows settings and open the "Ease of Access" section.
2. Click on "Text cursor" .
3. Enable the text cursor indicator.

I found it easy to reproduce this on Facebook, so, to reproduce:

1. Open facebook.com
2. Go into the messenger view, select a conversation.
3. Type a message and enter some emojis in-between, like "testing testing 🦊 testing testing", but make sure to use Facebooks UI to insert the emoji, and do not copy-paste it in.
4. Try moving the cursor backwards by using the left arrow.

At some point, it looks to occur reliably on the emoji, Firefox freezes for a couple of seconds. I could also reproduce this in GMail, and a friend said this is happening on more sites. Turning off the cursor indicator seems to make the problem go away.

I captured a profile: https://share.firefox.dev/34i6qlm and you can clearly observe the 2.3s peak on the parent process there. Even though the content process does not show jank, something is going on as the browser visibly freezes.

---

Filing in ::General, because I don't know where exactly the problem is. :)

Comment 1

[Dennis Schubert [:denschub]]

Pardon, wrong product.

Comment 2

[Ed Lee :Mardak]

(In reply to Dennis Schubert [:denschub] from comment #0)

I captured a profile: https://share.firefox.dev/34i6qlm and you can clearly observe the 2.3s peak on the parent process there.

Zooming in on the profile from 2.6s-4.6s…

Nearly 100% of samples include bool IA2ProxyTextRange::IterateOverSubRanges uiautomationcore.dll which calls into mozilla::a11y::AccessibleHandler::get_text for 20% of samples

https://searchfox.org/mozilla-central/rev/35245411b9e8a911fe3f5adb0632c3394f8b4ccb/accessible/ipc/win/handler/AccessibleHandler.cpp#1876

Moving to Disability Access APIs for someone with more familiarity with that code.

Comment 3

[David]

I am experiencing a similar problem, apparently caused by turning on the text cursor indicator in Microsoft Windows 10, Version 2004.

I can reproduce this consistently by creating a new email in Gmail and starting to type in text. At some point an autosave will occur, and usually soon after this Firefox becomes completely unresponsive. I may have to to close it using Task Manager.

If I perform exactly the same actions in Chrome, there is no problem.

Turning off the text cursor indicator prevents the problem from recurring.

I am running the latest versions of Windows 10 and Firefox (81.0.1 64-bit)

Comment 4

[Shaodan Hong]

I can reproduce this in Windows10 2004/Firefox 82.0.1 64-bit with some different details.

To reproduce:

1. Enable "text cursor indicator".
2. Typing any texts (even without emojis) into any text area on a site (e.g. the comment area on bugzilla).
3. Long press the Backspace button to remove the texts.

Then Firefox freezes.

Removing texts letter by letter by short press the Backspace button will not cause the problems.

Comment 5

[James Teh [:Jamie]]

Asa was able to reproduce this by typing rapidly in the address bar. It seems UIA uses IAccessibleText to get a line of text, but it gets stuck in a loop for some reason. I don't know whether UIA gets stuck in a loop making IA2 calls (which could be due to a bug on their side or ours) or whether the loop is happening in our own HyperTextAccessible code. I suspect the former. However, I'm pretty puzzled by the CharAt(int aOffset = 0n-1267966343, ...) in frame 2 and the GetChildIndexAtOffset(unsigned int aOffset = 0xb46c5e79) in frame 1. Those offsets are very wrong. Either the dump is giving me bogus values (possible) or something very wrong is happening in our code. I'll have to try to reproduce this myself to be sure.

Here's the stack dump:

0:000> ~0 kp
 # Child-SP          RetAddr           Call Site
00 000000c8`d33fc8c8 00007ffd`0d731c1b xul!__security_check_cookie(void)+0x16
01 000000c8`d33fc8d0 00007ffd`0d73386c xul!mozilla::a11y::HyperTextAccessible::GetChildIndexAtOffset(unsigned int aOffset = 0xb46c5e79)+0x10b [/builds/worker/checkouts/gecko/accessible/generic/HyperTextAccessible.cpp @ 2254] 
02 000000c8`d33fc950 00007ffd`0d732e35 xul!mozilla::a11y::HyperTextAccessible::CharAt(int aOffset = 0n-1267966343, class nsTSubstring<char16_t> * aChar = 0x000000c8`d33fc9d8, int * aStartOffset = 0x00000000`00000000, int * aEndOffset = 0x00000000`00000000)+0x1c [/builds/worker/checkouts/gecko/accessible/generic/HyperTextAccessible.h @ 167] 
03 (Inline Function) --------`-------- xul!mozilla::a11y::HyperTextAccessible::CharAt+0x3c [/builds/worker/checkouts/gecko/accessible/generic/HyperTextAccessible.h @ 181] 
04 (Inline Function) --------`-------- xul!mozilla::a11y::HyperTextAccessible::IsCharAt+0x3c [/builds/worker/checkouts/gecko/accessible/generic/HyperTextAccessible.h @ 189] 
05 (Inline Function) --------`-------- xul!mozilla::a11y::HyperTextAccessible::IsLineEndCharAt+0x3c [/builds/worker/checkouts/gecko/accessible/generic/HyperTextAccessible.h @ 195] 
06 000000c8`d33fc9b0 00007ffd`0d733b4a xul!mozilla::a11y::HyperTextAccessible::FindLineBoundary(unsigned int aOffset = 0, mozilla::a11y::HyperTextAccessible::EWhichLineBoundary aWhichLineBoundary = <Value unavailable error>)+0x425 [/builds/worker/checkouts/gecko/accessible/generic/HyperTextAccessible.cpp @ 825] 
07 000000c8`d33fcac0 00007ffd`0d6f60b5 xul!mozilla::a11y::HyperTextAccessible::TextAtOffset(int aOffset = 0n0, int aBoundaryType = <Value unavailable error>, int * aStartOffset = 0x000000c8`d33fcb74, int * aEndOffset = 0x000000c8`d33fcb70, class nsTSubstring<char16_t> * aText = 0x000000c8`d33fcb78)+0x25a [/builds/worker/checkouts/gecko/accessible/generic/HyperTextAccessible.cpp @ 1078] 
08 000000c8`d33fcb40 00007ffd`22769da1 xul!mozilla::a11y::ia2AccessibleText::get_textAtOffset(long aOffset = 0n0, IA2TextBoundaryType aBoundaryType = <Value unavailable error>, long * aStartOffset = 0x000000c8`d33fcd10, long * aEndOffset = 0x000000c8`d33fcd50, wchar_t ** aText = 0x000000c8`d33fcd18)+0x1a5 [/builds/worker/checkouts/gecko/accessible/windows/ia2/ia2AccessibleText.cpp @ 303] 
09 000000c8`d33fcc60 00007ffd`227ffd4b uiautomationcore!AccUtils::get_textAtOffset+0x69
0a 000000c8`d33fcce0 00007ffd`227f8786 uiautomationcore!IA2ProxyTextRange::Endpoint::GetIA2Bounds+0xa3
0b 000000c8`d33fcd40 00007ffd`227f8a7d uiautomationcore!<lambda_efd8f902d39a9d9b79a18de7aad93e3e>::operator()+0xfa
0c 000000c8`d33fce80 00007ffd`228045d6 uiautomationcore!std::_Func_class<bool,IA2ProxyTextRange * __ptr64>::operator()+0x31
0d 000000c8`d33fceb0 00007ffd`227fb036 uiautomationcore!IA2ProxyTextRange::IterateOverSubRanges+0x4aa
0e 000000c8`d33fd020 00007ffd`227fd4d3 uiautomationcore!IA2ProxyTextRange::EvaluateFunctionRecursively+0x166
0f 000000c8`d33fd0b0 00007ffd`2270a24b uiautomationcore!IA2ProxyTextRange::GetBoundingRectangles+0xe3
10 000000c8`d33fd1b0 00007ffd`2279ec33 uiautomationcore!ProviderCallouts::GetBoundingRectangles+0x3f
11 000000c8`d33fd1f0 00007ffd`227a021a uiautomationcore!`anonymous namespace'::GetBoundingRectanglesFromSimpleTextRange+0x43
12 000000c8`d33fd260 00007ffd`2267eb1a uiautomationcore!RemotePatternStub::TextRange_GetBoundingRectangles+0xaa
13 000000c8`d33fd2a0 00007ffd`2267e956 uiautomationcore!RemotePatternStub::ParseArgs+0x10a
14 000000c8`d33fd330 00007ffd`2267585c uiautomationcore!RemotePatternStub::OnMessage+0x146
15 000000c8`d33fd470 00007ffd`2268947e uiautomationcore!InvokeOnCorrectContext_Callback+0x10c
16 000000c8`d33fd500 00007ffd`226806ab uiautomationcore!ComInvoker::CallTarget+0x13e
17 000000c8`d33fd640 00007ffd`22690685 uiautomationcore!InvokeOnCorrectContext+0x9f
18 000000c8`d33fd6c0 00007ffd`2268fc39 uiautomationcore!ProcessIncomingRequest+0x385
19 000000c8`d33fd810 00007ffd`2267a317 uiautomationcore!HookBasedServerConnectionManager::HookCallback+0x1a9
1a 000000c8`d33fe8f0 00007ffd`2265acf5 uiautomationcore!HookUtil<&HookBasedClientConnection::HookCallback,0>::CallOut+0x17
1b 000000c8`d33fe930 00007ffd`2265a9b7 uiautomationcore!HandleSyncHookMessage+0x2c5
1c 000000c8`d33feab0 00007ffd`54f0e022 uiautomationcore!HookUtil<&HookBasedClientConnection::HookCallback,0>::CallWndProc+0x37
1d 000000c8`d33feae0 00007ffd`54f10bc3 user32!fnHkINLPCWPSTRUCTW+0xe2
1e 000000c8`d33feb90 00007ffd`5628fbd4 user32!_fnDWORD+0x33
1f 000000c8`d33febf0 00007ffd`53e01064 ntdll!KiUserCallbackDispatcher+0x24
20 000000c8`d33fec78 00007ffd`54efa5c3 win32u!NtUserPeekMessage+0x14
21 000000c8`d33fec80 00007ffd`54efa523 user32!_PeekMessage+0x43
22 000000c8`d33fecf0 00007ffd`548f3683 user32!PeekMessageW+0x143
23 000000c8`d33fed60 00007ffd`0ca2d67c msctf!CThreadInputMgr::PeekMessageW+0xa3
24 (Inline Function) --------`-------- xul!mozilla::widget::WinUtils::PeekMessage+0x49 [/builds/worker/checkouts/gecko/widget/windows/WinUtils.cpp @ 729] 
25 000000c8`d33fedb0 00007ffd`0c9ae9b8 xul!nsAppShell::ProcessNextNativeEvent(bool mayWait = <Value unavailable error>)+0xac [/builds/worker/checkouts/gecko/widget/windows/nsAppShell.cpp @ 702] 
26 (Inline Function) --------`-------- xul!nsBaseAppShell::DoProcessNextNativeEvent+0x29 [/builds/worker/checkouts/gecko/widget/nsBaseAppShell.cpp @ 120] 
27 000000c8`d33fee80 00007ffd`09a8b30e xul!nsBaseAppShell::OnProcessNextEvent(class nsIThreadInternal * thr = 0x00000250`5a9957c0, bool mayWait = <Value unavailable error>)+0x148 [/builds/worker/checkouts/gecko/widget/nsBaseAppShell.cpp @ 259] 
28 000000c8`d33fef10 00007ffd`0aa11790 xul!nsThread::ProcessNextEvent(bool aMayWait = <Value unavailable error>, bool * aResult = 0x000000c8`d33ff120)+0x17e [/builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp @ 1128] 
29 (Inline Function) --------`-------- xul!NS_ProcessNextEvent+0x27 [/builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.cpp @ 513] 
2a 000000c8`d33ff0f0 00007ffd`0a9e5e3f xul!mozilla::ipc::MessagePump::Run(class base::MessagePump::Delegate * aDelegate = 0x00000250`5a992040)+0x210 [/builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp @ 109] 
2b (Inline Function) --------`-------- xul!MessageLoop::RunInternal+0x16 [/builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc @ 334] 
2c 000000c8`d33ff190 00007ffd`09a5e10e xul!MessageLoop::RunHandler(void)+0x2f [/builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc @ 328] 
2d 000000c8`d33ff1e0 00007ffd`09c36678 xul!MessageLoop::Run(void)+0x4e [/builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc @ 310] 
2e 000000c8`d33ff240 00007ffd`09c359ff xul!nsBaseAppShell::Run(void)+0x28 [/builds/worker/checkouts/gecko/widget/nsBaseAppShell.cpp @  139] 

Comment 6

[James Teh [:Jamie]]

(In reply to James Teh [:Jamie] from comment #5)

Asa was able to reproduce this by typing rapidly in the address bar. It seems UIA uses IAccessibleText to get a line of text, but it gets stuck in a loop for some reason. I don't know whether UIA gets stuck in a loop making IA2 calls (which could be due to a bug on their side or ours) or whether the loop is happening in our own HyperTextAccessible code.

Turns out it was the latter in this case; I filed bug 1675172. However, that can't have been the issue for all users experiencing this, since bug 1675172 is a new regression which landed weeks after this problem was first reported. I think we need to fix bug 1675172 and then re-test to track down the remaining problems.

Comment 7

[ecroze]

I am facing the same problem: Windows 10 20H2 with text cursor indicator enabled. The computer freezes for a few dozens of seconds when suppressing characters with DEL key or going backward with the left arrow.

Comment 9

[fuzzlebang2]

Any news after a year?

Windows 10 21H2 19044.1526
Firefox 97.0
I have the same problem. Even typing this text I faced with 10-15 seconds hang. Browser completely hangs, all I can do is move a mouse. Unfortunately, using Firefox becomes unbearably painful.

Comment 10

[James Teh [:Jamie]]

It would be interesting to know whether the major re-architecture we're currently working on helps here. This is months away from shipping yet and not yet ready for daily usage, but if you're willing to test it, you can do so as follows:

1. In the address bar, go to the address: about:config
2. Search for accessibility.cache.enabled and press the Toggle button on the resulting row to set it to true.
3. Restart Firefox.
4. Test with Text Cursor Indicator to see if you can still reproduce the freeze.

Once you're done testing, you should probably disable this, as I can't guarantee it will be stable or reliable. To do that, repeat steps 1 to 3, except set it to false instead of true in step 2.

Comment 11

[fuzzlebang2]

(In reply to James Teh [:Jamie] from comment #10)

It would be interesting to know whether the major re-architecture we're currently working on helps here. This is months away from shipping yet and not yet ready for daily usage, but if you're willing to test it, you can do so as follows:

1. In the address bar, go to the address: about:config
2. Search for accessibility.cache.enabled and press the Toggle button on the resulting row to set it to true.
3. Restart Firefox.
4. Test with Text Cursor Indicator to see if you can still reproduce the freeze.

Once you're done testing, you should probably disable this, as I can't guarantee it will be stable or reliable. To do that, repeat steps 1 to 3, except set it to false instead of true in step 2.

If accessibility.cache.enabled is set to true, I don't see the text cursor indicator anywhere.

Comment 12

[James Teh [:Jamie]]

Oh. Durp. We don't cache screen coordinates for text yet. Sorry.

Comment 14

[fuzzlebang2]

Has there been any progress with this bug?

Comment 15

[James Teh [:Jamie]]

In order for this to have a chance of working with the cache (comment 10), we need bug 1735101. That's currently being worked on, but it isn't finished yet. Once it is, I'll have something for you to test.

Comment 16

[James Teh [:Jamie]]

Since bug 1735101 has landed now, it would be interesting to know what you get with the instructions in comment 10 if you're able/willing to test again. Thanks.

Comment 17

[BugBot [:suhaib / :marco/ :calixte]]

Redirect a needinfo that is pending on an inactive user to the triage owner.
:Jamie, since the bug has high severity and recent activity, could you please find another way to get the information or close the bug as INCOMPLETE if it is not actionable?

For more information, please visit auto_nag documentation.

Comment 18

[fuzzlebang2]

Looks better, but there are freezes in large pdf files. I'm not sure if it's related to this bug.

Comment 19

[James Teh [:Jamie]]

This should be resolved by Cache the World, which is enabled by default in Firefox 113.