1777962 - Crash in [@ mozilla::a11y::GeckoTextMarkerRange::AttributedText], Mach RPC related

Status: NEW

(Core :: Disability Access APIs, defect)

Description

[Gabriele Svelto [:gsvelto]]

Crash report: https://crash-stats.mozilla.org/report/index/f7801350-b7a8-49f5-8340-345ab0220702

Reason: EXC_BAD_ACCESS / KERN_INVALID_ADDRESS

Top 10 frames of crashing thread:

0 None @0x0005801000000000 
1 XUL mozilla::a11y::GeckoTextMarkerRange::AttributedText const accessible/mac/GeckoTextMarker.mm:468
2 XUL -[MOXAccessibleBase accessibilityAttributeValue:forParameter:] accessible/mac/MOXAccessibleBase.mm:359
3 AppKit ___NSAccessibilityEntryPointValueForAttributeWithParameter_block_invoke.904 
4 None @0x22780001a9d7db8c 
5 AppKit NSAccessibilityPerformEntryPointObject 
6 None @0x451f0001a9b663d0 
7 AppKit CopyParameterizedAttributeValue 
8 None @0xc2438001ac819ba8 
9 HIServices _XCopyParameterizedAttributeValue 

It seems like we're accessing a NULL pointer. Crashes have different signatures but the failure occurs when dealing with the same code.

Comment 1

[BugBot [:suhaib / :marco/ :calixte]]

Since the crash volume is low (less than 5 per week), the severity is downgraded to S3. Feel free to change it back if you think the bug is still critical.

For more information, please visit auto_nag documentation.

Comment 2

[Steven Michaud [:smichaud] (Retired)]

There are actually quite a few of these crashes, under different signatures, all involving the MOXAccessibleBase class from accessible/mac/MOXAccessibleBase.h. Judging by the MIG calls in their stack traces, they all have to do with Mach RPC. I don't know why they only happen on macOS.

https://crash-stats.mozilla.org/search/?proto_signature=~MOXAccessibleBase&date=%3E%3D2022-12-02T17%3A52%3A00.000Z&date=%3C2023-01-02T17%3A52%3A00.000Z&_facets=signature&_facets=proto_signature&_facets=platform_version&_facets=cpu_arch&_facets=address&_sort=-date&_columns=date&_columns=signature&_columns=product&_columns=version&_columns=build_id&_columns=platform#facet-proto_signature

Comment 3

[Steven Michaud [:smichaud] (Retired)]

Needless to say, this is probably a macOS bug (since these crashes only happen on macOS). But it may be possible to work around it in Mozilla code.