1717575 - Crash in [@ PLDHashTable::Iterator::Iterator | ConvertToAtkAttributeSet]

Status: RESOLVED FIXED

(Core :: Disability Access APIs, defect)

Description

[Gabriele Svelto [:gsvelto]]

Crash report: https://crash-stats.mozilla.org/report/index/f256901d-4481-4bf8-b276-ea9e50210621

Reason: SIGSEGV /SEGV_MAPERR

Top 10 frames of crashing thread:

0 libxul.so PLDHashTable::Iterator::Iterator xpcom/ds/PLDHashTable.cpp:753
1 libxul.so ConvertToAtkAttributeSet accessible/atk/AccessibleWrap.cpp:641
2 libxul.so getAttributesCB accessible/atk/AccessibleWrap.cpp:668
3 libatk-bridge-2.0.so.0 impl_GetAttributes ./obj-x86_64-linux-gnu/../atk-adaptor/adaptors/accessible-adaptor.c:471
4 libatk-bridge-2.0.so.0 handle_message ./obj-x86_64-linux-gnu/../droute/droute.c:601
5 libdbus-1.so.3 _dbus_object_tree_dispatch_and_unlock dbus/dbus-object-tree.c:1020
6 libdbus-1.so.3 dbus_connection_dispatch dbus/dbus-connection.c:4576
7 libatspi.so.0 message_queue_dispatch atspi/atspi-gmain.c:89
8 libglib-2.0.so.0 g_main_context_dispatch glib/gmain.c:4043
9 libglib-2.0.so.0 g_main_context_iterate.constprop.0 glib/gmain.c:4119

This is a Linux-specific crash coming from users with accessibility enabled. The crash itself seems like a simple NULL pointer access but I'm not sufficiently familiar with the code to parse why it might be happening.

This appears to be a regression as it started in buildid 20210611094205 and is only present on nightly for the time being.

Comment 1

[Andrew McCreight [:mccr8]]

This signature looks very similar, so I'll add it.

Comment 2

[Julien Cristau [:jcristau] (back April 22)]

Bug 1714390 landed in 20210611094205 and touched atk. Eitan, can this be related?

Comment 3

[Eitan Isaacson [:eeejay]]

Attachment: Bug 1717575 - Check given attributes for null before iterating. r?morgan

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/f9224c70120b
Check given attributes for null before iterating. r=morgan

Comment 5

[Sandor Molnar[:smolnar]]

https://hg.mozilla.org/mozilla-central/rev/f9224c70120b

Comment 6

[Pascal Chevrel:pascalc]

We had crashes on 91 beta 2 with this signature, should we uplift that fix to beta?

Comment 7

[Ryan VanderMeulen [:RyanVM]]

Please nominate this for ESR91 approval when you get a chance.

Comment 8

[Eitan Isaacson [:eeejay]]

Comment on attachment 9231006 [details]
Bug 1717575 - Check given attributes for null before iterating. r?morgan

ESR Uplift Approval Request

• If this is not a sec:{high,crit} bug, please state case for ESR consideration: This is a crasher
• User impact if declined:
• Fix Landed on Version:
• Risk to taking this patch: Low
• Why is the change risky/not risky? (and alternatives if risky): this is a simple null check.
• String or UUID changes made by this patch:

Comment 9

[Ryan VanderMeulen [:RyanVM]]

Comment on attachment 9231006 [details]
Bug 1717575 - Check given attributes for null before iterating. r?morgan

Approved for 91.1esr.

Comment 10

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-esr91/rev/5a4b54a49fe7

Comment 11

[Julien Cristau [:jcristau] (back April 22)]

I'm going to go ahead and take this fix for 91.0.1, given the simple patch and crash volume on release.

Comment 12

[Julien Cristau [:jcristau] (back April 22)]

https://hg.mozilla.org/releases/mozilla-release/rev/7dafd5f51c0a

Comment 13

[Julien Cristau [:jcristau] (back April 22)]

for 91.0.1esr (FIREFOX_91_0_X_RELBRANCH):
https://hg.mozilla.org/releases/mozilla-esr91/rev/8046f1ae74749dd164478750e0d7a0d529313403