1786638 - Crash in [@ refRelationSetCB]

Status: RESOLVED FIXED

(Core :: Disability Access APIs, defect)

Description

[Morgan Reschenberg [:morgan]]

Crash report: https://crash-stats.mozilla.org/report/index/951d96e7-4298-4560-82fa-43afb0220823

Reason: SIGSEGV / SEGV_MAPERR

Top 10 frames of crashing thread:

0 libxul.so refRelationSetCB accessible/atk/AccessibleWrap.cpp:840
1 libatk-bridge-2.0.so.0 spi_atk_add_client 
2 libatk-bridge-2.0.so.0 str_pair_equal 
3 libdbus-1.so.3 dbus_connection_dispatch 
4 libatspi.so.0 message_queue_dispatch /usr/src/debug/at-spi2-core/atspi/atspi-gmain.c:89
5 libglib-2.0.so.0 g_main_context_dispatch /usr/src/debug/glib/glib/gmain.c:4135
6 libglib-2.0.so.0 g_main_context_iterate.constprop.0 /usr/src/debug/glib/glib/gmain.c:4211
7 libglib-2.0.so.0 g_main_context_iteration /usr/src/debug/glib/glib/gmain.c:4276
8 libxul.so nsThread::ProcessNextEvent xpcom/threads/nsThread.cpp:1121
9 libxul.so mozilla::ipc::MessagePump::Run ipc/glue/MessagePump.cpp:85

Comment 1

[Morgan Reschenberg [:morgan]]

Attachment: Bug 1786638: Return early if we can't fetch an internal obj when computing ATK relations r?Jamie

Comment 2

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/ed231c100cea
Return early if we can't fetch an internal obj when computing ATK relations r=Jamie

Comment 3

[Iulian Moraru]

https://hg.mozilla.org/mozilla-central/rev/ed231c100cea

Comment 4

[aarnaarn2]

hello, I don't know what disabled status on ff105 version means but my firefox 105.0 on Arch Linux is crashing constantly now.

https://crash-stats.mozilla.org/report/index/bp-4f85ec68-c2ce-4c0e-bd6f-22e600220921

Comment 5

[Jan Alexander Steffens [:heftig]]

Maybe Ryan misread the code? This crash can only happen when the cache is disabled (the default on all desktop channels), not enabled.

   if (!StaticPrefs::accessibility_cache_enabled_AtStartup() &&
       acc->IsRemote()) {

A null dereference of acc here requires accessibility.cache.enabled be false.

Comment 6

[Ryan VanderMeulen [:RyanVM]]

Indeed, sorry for that :(. Morgan, can you please nominate this for release approval so we can get this uplifted to a 105 dot release?

Comment 7

[Morgan Reschenberg [:morgan]]

Comment on attachment 9291243 [details]
Bug 1786638: Return early if we can't fetch an internal obj when computing ATK relations r?Jamie

Beta/Release Uplift Approval Request

• User impact if declined: Users will continue to experience this crash
• Is this code covered by automated tests?: No
• Has the fix been verified in Nightly?: Yes
• Needs manual test from QE?: No
• If yes, steps to reproduce:
• List of other uplifts needed: None
• Risk to taking this patch: Low
• Why is the change risky/not risky? (and alternatives if risky): This is just an additional null check, so it shouldn't have any adverse affects on users.
• String changes made/needed:
• Is Android affected?: No

Comment 8

[Ryan VanderMeulen [:RyanVM]]

Comment on attachment 9291243 [details]
Bug 1786638: Return early if we can't fetch an internal obj when computing ATK relations r?Jamie

Approved for 105.0.1. We don't have a firm ETA on when that'll ship yet, but it'll be by October 4 at the latest.

Comment 9

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-release/rev/5042ee204b92

Comment 10

[Ryan VanderMeulen [:RyanVM]]

Just to close the loop, 105.0.1 is expected to ship tomorrow with this fix included.