1748775 - Crash in [@ objc_msgSend | -[mozColumnContainer moxUnignoredChildren]]

Status: RESOLVED FIXED

(Core :: Disability Access APIs, defect, P1)

Description

[Eitan Isaacson [:eeejay]]

Crash report: https://crash-stats.mozilla.org/report/index/b3d5a644-e163-4da0-8f29-534940220105

Reason: EXC_BAD_ACCESS / KERN_INVALID_ADDRESS

Top 10 frames of crashing thread:

0 libobjc.A.dylib objc_msgSend 
1 XUL -[mozColumnContainer moxUnignoredChildren] accessible/mac/mozTableAccessible.mm:52
2 XUL -[MOXAccessibleBase accessibilityAttributeValue:] accessible/mac/MOXAccessibleBase.mm:140
3 AppKit NSAccessibilityGetObjectForAttributeUsingLegacyAPI 
4 None @0xba7f0001b1927c44 
5 AppKit ___NSAccessibilityEntryPointValueForAttribute_block_invoke.861 
6 None @0xab1f8001b15e4b50 
7 AppKit _NSAccessibilityEntryPointValueForAttribute 
8 None @0xcc310001b1708134 
9 AppKit -[NSObject accessibilityArrayAttributeCount:] 

Comment 1

[Eitan Isaacson [:eeejay]]

Attachment: Bug 1748775 - Expire column children when table expires. r?morgan!

I think there is a potential crasher if an AT holds a reference to a column object while its parent table expires, and then tries to retrieve AXChildren. We need to expire te column objects when the table expires or is destroyed.

Comment 2

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/cda786ac3fa7
Expire column children when table expires. r=morgan

Comment 3

[Atila Butkovits]

https://hg.mozilla.org/mozilla-central/rev/cda786ac3fa7

Comment 4

[BugBot [:suhaib / :marco/ :calixte]]

The patch landed in nightly and beta is affected.
:eeejay, is this bug important enough to require an uplift?
If not please set status_beta to wontfix.

For more information, please visit auto_nag documentation.

Comment 5

[Eitan Isaacson [:eeejay]]

Comment on attachment 9259621 [details]
Bug 1748775 - Expire column children when table expires. r?morgan!

Beta/Release Uplift Approval Request

• User impact if declined: Potential crasher in gmail with VoiceOver
• Is this code covered by automated tests?: Yes
• Has the fix been verified in Nightly?: Yes
• Needs manual test from QE?: No
• If yes, steps to reproduce:
• List of other uplifts needed: None
• Risk to taking this patch: Low
• Why is the change risky/not risky? (and alternatives if risky): This is not a functional/user visible change but just an extra step to fix accessible object's lifecycles.
• String changes made/needed:

Comment 6

[Ryan VanderMeulen [:RyanVM]]

Comment on attachment 9259621 [details]
Bug 1748775 - Expire column children when table expires. r?morgan!

Approved for 97.0b9.

Comment 7

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-beta/rev/a716ed6737c2