1789396 - Crash in [@ mozilla::a11y::RemoteAccessibleBase<T>::BoundsWithOffset]

Status: RESOLVED FIXED

(Core :: Disability Access APIs, defect)

Description

[Marco Zehe (:MarcoZ)]

Crash report: https://crash-stats.mozilla.org/report/index/f06b726e-87e3-4bf7-a2ee-7daa40220906

Reason: EXCEPTION_ACCESS_VIOLATION_READ

Top 10 frames of crashing thread:

0 xul.dll mozilla::a11y::RemoteAccessibleBase<mozilla::a11y::RemoteAccessible>::BoundsWithOffset const accessible/ipc/RemoteAccessibleBase.cpp:617
1 xul.dll mozilla::a11y::RemoteAccessibleBase<mozilla::a11y::RemoteAccessible>::Bounds const accessible/ipc/RemoteAccessibleBase.cpp:638
2 xul.dll mozilla::a11y::RemoteAccessible::Bounds const accessible/ipc/win/RemoteAccessible.cpp:242
3 xul.dll mozilla::a11y::RemoteAccessibleBase<mozilla::a11y::RemoteAccessible>::ChildAtPoint accessible/ipc/RemoteAccessibleBase.cpp:403
4 xul.dll mozilla::a11y::OuterDocAccessible::ChildAtPoint accessible/generic/OuterDocAccessible.cpp:224
5 xul.dll mozilla::a11y::MsaaAccessible::accHitTest accessible/windows/msaa/MsaaAccessible.cpp:1632
6 rpcrt4.dll Invoke 
7 None @0x0000012fba45324f 
8 oleacc.dll <unknown in oleacc.dll> 
9 rpcrt4.dll ?Ndr64StubWorker@@YAJPEAX0PEAU_RPC_MESSAGE@@PEAU_MIDL_SERVER_INFO_@@PEBQ6AJXZPEAU_MIDL_SYNTAX_INFO@@PEAK@Z 

I got this while opening another bug from a Bugmail message in Gmail. I had JAWS running at the time, CTW is enabled. On next try, this was not reproducible.

Comment 1

[James Teh [:Jamie]]

I guess the OuterDocAccessible (associated with the browser element) died before the DocAccessibleParent did. If I read this correctly, we assume that a remote doc will always have a parent, but it won't if the OuterDocAccessible died.

Comment 2

[James Teh [:Jamie]]

Attachment: Bug 1789396: Null check acc before calling AsLocal() in RemoteAccessibleBase::BoundsWithOffset.

We expect acc to be a local OuterDocAccessible.
However, the OuterDocAccessible might die before the top level DocAccessibleParent, in which case acc will be null.
In this case, the DocAccessibleParent is about to die anyway, so it doesn't matter that the bounds we return are slightly wrong (since they can't take the OuterDoc into account).

Comment 3

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/67a91559cb78
Null check acc before calling AsLocal() in RemoteAccessibleBase::BoundsWithOffset. r=morgan

Comment 4

[Cosmin Sabou [:CosminS]]

https://hg.mozilla.org/mozilla-central/rev/67a91559cb78