1820069 - [CTW] Crash in [@ mozilla::detail::InvalidArrayIndex_CRASH | nsTArray_Impl<T>::ElementAt | mozilla::a11y::TextLeafPoint::CharBounds]

Status: RESOLVED FIXED

(Core :: Disability Access APIs, defect, P1)

Description

[James Teh [:Jamie]]

Crash report: https://crash-stats.mozilla.org/report/index/e68e7f71-e875-45eb-ad0d-783730230303

Reason: EXCEPTION_BREAKPOINT

Top 10 frames of crashing thread:

0  mozglue.dll  MOZ_Crash  mfbt/Assertions.h:261
0  mozglue.dll  mozilla::detail::InvalidArrayIndex_CRASH  mfbt/Assertions.cpp:50
1  xul.dll  nsTArray_Impl<nsRect, nsTArrayInfallibleAllocator>::ElementAt  xpcom/ds/nsTArray.h:1194
1  xul.dll  mozilla::a11y::TextLeafPoint::CharBounds  accessible/base/TextLeafRange.cpp:1674
2  xul.dll  mozilla::a11y::HyperTextAccessibleBase::CharBounds  accessible/basetypes/HyperTextAccessibleBase.cpp:219
3  xul.dll  mozilla::a11y::ia2AccessibleText::get_characterExtents  accessible/windows/ia2/ia2AccessibleText.cpp:120
4  rpcrt4.dll  Invoke  
5  rpcrt4.dll  NdrStubCall2  
6  combase.dll  CStdStubBuffer_Invoke  onecore\com\combase\ndr\ndrole\stub.cxx:1552
7  rpcrt4.dll  CStdStubBuffer_Invoke  

This occurs when calling HyperTextAccessibleBase::CharBounds with TEXT_OFFSET_CARET on a cached RemoteAccessible. We need to convert these magic offsets like we do in other HyperText functions.

Comment 1

[James Teh [:Jamie]]

Attachment: Bug 1820069: Fix handling of magic offsets in HyperTextAccessible*::Char/TextBounds.

1. HyperTextAccessibleBase::CharBounds didn't have code to support magic offsets (like TEXT_OFFSET_CARET) at all, resulting in a crash.
2. HyperTextAccessibleBase::TextBounds handled the end offset being a magic offset, but not the start offset.
3. HyperTextAccessible::CharBounds assumed it could just add 1 to the start offset to pass to TextBounds, which resulted in returning the rect from the caret to the end of the container, since length (-1) is caret (-2) + 1.

This patch addresses all three of these issues.

Comment 2

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/cc49a4388379
Fix handling of magic offsets in HyperTextAccessible*::Char/TextBounds. r=morgan

Comment 3

[Atila Butkovits]

https://hg.mozilla.org/mozilla-central/rev/cc49a4388379