1773476 - crash on hover over non-ascii characters after iframe display toggle

Status: RESOLVED INCOMPLETE

(Core :: Layout, defect)

Description

[James Richardson]

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:101.0) Gecko/20100101 Firefox/101.0

Steps to reproduce:

Behavior appears to have started in Firefox 94, confirmed by multiple users with varying Firefox extension configurations, all running on Windows 10.

This is easy to reproduce on a proprietary web app, but I don't have an exact minimal set of repro steps, but generally the steps are as follows:
An outer web page contains an iframe. The web page within the iframe contains some content that main contain non-ascii (simple chinese) characters within its content. When the iframe's css display property is toggled from inline to none and back to inline again, and focus is given to the iframe content with a single click, hovering over the non-ascii characters results in a firefox crash. The website is configured for accessibility including no-vision (but no screen reader is active on any of the machines where this was reproduced), so aria labels could be involved.

Actual results:

The Firefox tab crashes displaying the tab crash reporter screen.

The following stack trace was in the crash dump:
0077b5a8 66b53ca5 0000003a 00000006 00000000 mozglue!mozilla::detail::InvalidArrayIndex_CRASH+0x16
0077b730 6792ceba 00004e2d 00000000 00006587 xul!workerlz4_compress+0x6b5905
0077b860 677f14ef 23d3feb0 0077bd40 00000000 xul!GIFFT_TimingDistributionStopAndAccumulate+0x776d7a
0077bc4c 68d14599 0077bc74 0077bd40 0000000a xul!GIFFT_TimingDistributionStopAndAccumulate+0x63b3af
0077bca0 69646bc4 0077bd40 0000000a 00000000 xul!VR_RuntimePath+0x77a449
0077be60 68cdc677 0077bfc8 0000000a 677d8600 xul!soundtouch::SoundTouch::operator=+0x71b3e4
0077c05c 68cdcd23 0077c070 00000002 0077c0b8 xul!VR_RuntimePath+0x742527
0077c0a0 68980896 0077c0d0 0077c0b8 ffffff81 xul!VR_RuntimePath+0x742bd3
0077c178 67671702 09a12200 0077c1c0 2426f000 xul!VR_RuntimePath+0x3e6746
0077c1e0 3fd4c3cc 09a12200 00000001 0077c208 xul!GIFFT_TimingDistributionStopAndAccumulate+0x4bb5c2
0077c220 29823030 3fca83dd 00006021 18730800 0x3fd4c3cc
0077c28c 3fd4373b 00001842 211bbb20 00000001 0x29823030
0077c2b0 2127e010 3fca83dd 00007021 18730800 0x3fd4373b
0077c32c 3fd4b172 00002042 09d656a8 00000002 0x2127e010
0077c358 0c432358 43c23f97 0000b821 00000000 0x3fd4b172
0077c4a0 676a1452 09a12200 0077c4e8 3fca073b 0xc432358
0077c4e8 676452bb 43c235f0 00000002 0077c730 xul!GIFFT_TimingDistributionStopAndAccumulate+0x4eb312
0077c620 676a1452 09a12200 0077c64c 80000003 xul!GIFFT_TimingDistributionStopAndAccumulate+0x48f17b
0077c6c0 676a4b7f 09a12200 0077c8e0 0077c8e8 xul!GIFFT_TimingDistributionStopAndAccumulate+0x4eb312
0077c77c 676a1158 09a12200 00000002 0077c8d8 xul!GIFFT_TimingDistributionStopAndAccumulate+0x4eea3f
0077c820 67cfc095 09a12200 0077c870 0077c880 xul!GIFFT_TimingDistributionStopAndAccumulate+0x4eb018
0077c930 3fca3342 09a12200 0077c96c 00000000 xul!GIFFT_TimingDistributionStopAndAccumulate+0xb45f55
0077c934 09a12200 0077c96c 00000000 00000000 0x3fca3342
0077c938 0077c96c 00000000 00000000 00000002 0x9a12200
0077c93c 00000000 00000000 00000002 0077c980 0x77c96c

Expected results:

Firefox should function as usual.

Comment 1

[Negritas Sergiu, Desktop QA]

Hello! I have tried to reproduce the issue with firefox 103.0a1(2022-06-14) on Windows 10, unfortunately I wasn't able to reproduce the issue.
Could you please answer the following questions in order to further investigate this issue

1. Could you please provide a test case with the iframe or a website where you encountered this issue.
2. Could you attach the crash report from about:crashes.
3. Does this issue happen with a new profile? Here is a link on how to create one: https://support.mozilla.org/en-US/kb/profile-manager-create-remove-switch-firefox-profiles
4. Does this issue happen in the latest nightly? Here is a link from where you can download it: https://www.mozilla.org/en-US/firefox/channel/desktop/
5. Do you have any addons installed if so can you list them?

Comment 2

[BugBot [:suhaib / :marco/ :calixte]]

The Bugbug bot thinks this bug should belong to the 'Core::Disability Access APIs' component, and is moving the bug to that component. Please correct in case you think the bot is wrong.

Comment 3

[James Teh [:Jamie]]

Nothing here has yet confirmed that this is an accessibility APIs bug, so moving back to untriaged for now.

Comment 4

[BugBot [:suhaib / :marco/ :calixte]]

Redirect a needinfo that is pending on an inactive user to the triage owner.
:dholbert, since the bug has recent activity, could you have a look please?

For more information, please visit auto_nag documentation.

Comment 5

[Suhaib Mujahid [:suhaib]]

Sorry, there was a problem with the detection of inactive users. I'm reverting the change.

Comment 6

[Jonathan Kew [:jfkthame]]

James Richardson: could you review the questions in comment 1 and provide any additional information as requested there?

Also, it would help if you can give a link to an actual crash report; see about:crashes (check the times of the reports to confirm which crash report corresponds to this problem). Thanks!

Comment 7

[BugBot [:suhaib / :marco/ :calixte]]

A needinfo is requested from the reporter, however, the reporter is inactive on Bugzilla. Given that the bug is still UNCONFIRMED, closing the bug as incomplete.

For more information, please visit BugBot documentation.