1844213 - Crash in [@ PrefWrapper::WantValueKind] (Should not access the preference 'accessibility.tabfocus' in the Content Processes)

Status: RESOLVED FIXED

(Core :: DOM: UI Events & Focus Handling, defect)

Description

[Ryan VanderMeulen [:RyanVM]]

Crash report: https://crash-stats.mozilla.org/report/index/8e136ed1-bb4e-43c9-8318-25ab10230717

MOZ_CRASH Reason: Should not access the preference 'accessibility.tabfocus' in the Content Processes

Top 10 frames of crashing thread:

0  XUL  PrefWrapper::WantValueKind const  modules/libpref/Preferences.cpp
1  XUL  PrefWrapper::GetValue const  modules/libpref/Preferences.cpp:1246
1  XUL  mozilla::Internals::GetPrefValue<int*&>  modules/libpref/Preferences.cpp:4685
2  XUL  mozilla::Preferences::GetInt  modules/libpref/Preferences.cpp:5042
2  XUL  nsXPLookAndFeel::GetIntValue  widget/nsXPLookAndFeel.cpp:1044
2  XUL  mozilla::LookAndFeel::GetInt  widget/nsXPLookAndFeel.cpp:1502
3  XUL  nsFocusManager::DetermineElementToMoveFocus  dom/base/nsFocusManager.cpp:3355
4  XUL  mozilla::IsNextFocusableElementTextControl  dom/events/IMEStateManager.cpp:1514
4  XUL  mozilla::GetActionHint  dom/events/IMEStateManager.cpp:1632
4  XUL  mozilla::IMEStateManager::SetIMEState  dom/events/IMEStateManager.cpp:1745

Comment 1

[James Teh [:Jamie]]

If I understand the pref blocking code correctly, it shouldn't block preferences that are listed in all.js. accessibility.tabfocus is listed in all.js, but only for non-Windows platforms. For Mac, it's deliberately left undefined as a signal to use the OS setting by default. So, I think a user has set this in about:config and now it's crashing.

Note that in bug 1628476, this preference has been exposed in about:Preferences, but that's only in 117. This crash occurred on 116 beta. Still, I'm surprised we've never seen this before now.

Ideally, there should probably be a value for this pref (-1 or something) which means "use the OS setting" and that should be the default value for Mac. However, there's probably an easier way to fix this, which is to add accessibility.tabfocus to the allow list.

dveditz, does this seem reasonable to you? (Tagging you since tjr is out of office.)

Moving this to DOM because even though this is related to accessibility, it is not related to accessibility APIs, but rather tab key handling.

Comment 2

[BugBot [:suhaib / :marco/ :calixte]]

The bug is linked to a topcrash signature, which matches the following criterion:

• Top 5 desktop browser crashes on Mac on beta

For more information, please visit BugBot documentation.

Comment 3

[Morgan Reschenberg [:morgan]]

Attachment: Bug 1844213: Add accessibility.tabfocus to the dynamic pref override list r?Jamie

Comment 4

[Jason Prickett]

Attachment: Bug 1844213 - Implement ability to hide steps indicator in about welcome r=aminomancer

Comment 5

[Phabricator Automation]

Comment on attachment 9345291 [details]
Bug 1844213 - Implement ability to hide steps indicator in about welcome r=aminomancer

Revision D184346 was moved to bug 1844212. Setting attachment 9345291 [details] to obsolete.

Comment 6

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/4418d5fd439b
Add accessibility.tabfocus to the dynamic pref override list r=Jamie

Comment 7

[Cristina Horotan [:chorotan]]

https://hg.mozilla.org/mozilla-central/rev/4418d5fd439b

Comment 8

[Dianna Smith [:diannaS]]

:morgan do you want to consider this for uplift if the opportunity arises in 116?

Comment 9

[Cristina Horotan [:chorotan]]

https://hg.mozilla.org/mozilla-central/rev/4418d5fd439b

Comment 10

[Morgan Reschenberg [:morgan]]

(In reply to Dianna Smith [:diannaS] from comment #8)

:morgan do you want to consider this for uplift if the opportunity arises in 116?

yes :) will request

Comment 11

[Morgan Reschenberg [:morgan]]

Comment on attachment 9344711 [details]
Bug 1844213: Add accessibility.tabfocus to the dynamic pref override list r?Jamie

Beta/Release Uplift Approval Request

• User impact if declined: Users will continue to experience this crash
• Is this code covered by automated tests?: No
• Has the fix been verified in Nightly?: No
• Needs manual test from QE?: Yes
• If yes, steps to reproduce: In about:preferences, attempt to check/uncheck the Keyboard navigation setting at the bottom of the page
• List of other uplifts needed: None
• Risk to taking this patch: Low
• Why is the change risky/not risky? (and alternatives if risky): This change adds this pref to an allow list, which is the root of this crash.
• String changes made/needed:
• Is Android affected?: No

Comment 12

[Dianna Smith [:diannaS]]

Comment on attachment 9344711 [details]
Bug 1844213: Add accessibility.tabfocus to the dynamic pref override list r?Jamie

Switching flag because we are in RC Week :)

Comment 13

[Alexandru Trif, Desktop Test Engineering [:atrif] [PTO 15-29 Aug, please ni? :mboldan]]

Hello! I tried to reproduce the issue with Firefox 117.0a1 (2023-07-18) on macOS 12.6 and 13.4 ARM by checking and unchecking the Use the tab key to move focus between form controls and links option from about:preferences > Browsing area but with no luck. I have also tried Firefox 116.0b5 but I don't have the Use the tab key to move focus between form controls and links option available.
Is there something that needs to be done first to successfully reproduce the issue by checking and unchecking the above option with Firefox 117.0a1 (2023-07-18)? Or this only reproduces on 116.0b5? If so how can I have the option displayed there as well in about:preferences? Thank you in advance!

Comment 14

[Morgan Reschenberg [:morgan]]

(In reply to Alexandru Trif, Desktop QA [:atrif] from comment #13)

Hello! I tried to reproduce the issue with Firefox 117.0a1 (2023-07-18) on macOS 12.6 and 13.4 ARM by checking and unchecking the Use the tab key to move focus between form controls and links option from about:preferences > Browsing area but with no luck. I have also tried Firefox 116.0b5 but I don't have the Use the tab key to move focus between form controls and links option available.
Is there something that needs to be done first to successfully reproduce the issue by checking and unchecking the above option with Firefox 117.0a1 (2023-07-18)? Or this only reproduces on 116.0b5? If so how can I have the option displayed there as well in about:preferences? Thank you in advance!

This pref didn't exist prior to the regressing bug, so it won't be in preferences in older builds.

Can you try toggling the preference, loading this test case, and tabbing through the controls?

data:text/html,<button>button</button><a href="mozilla.org">link</a><select><option>a</option><option>b</option></select>

Also, make sure you have System Settings > Keyboard > Keyboard Navigation turned off in macOS system settings

Comment 15

[Alexandru Trif, Desktop Test Engineering [:atrif] [PTO 15-29 Aug, please ni? :mboldan]]

(In reply to Morgan Reschenberg [:morgan] from comment #14)

This pref didn't exist prior to the regressing bug, so it won't be in preferences in older builds.

Can you try toggling the preference, loading this test case, and tabbing through the controls?

data:text/html,<button>button</button><a href="mozilla.org">link</a><select><option>a</option><option>b</option></select>

Also, make sure you have System Settings > Keyboard > Keyboard Navigation turned off in macOS system settings

Hello! I tried reproducing the issue while having Keyboard Navigation turned off in the macOS system settings and Use the tab key to move focus between form controls and links enabled in about preferences by using the tab key to navigate on the above test case multiple times but the issue does not reproduce. The testing was performed with Firefox 117.0a1 (2023-07-18) on macOS 12 and macOS 13 ARM.
If there are other scenarios that we can try please let us know. Thank you!

Comment 16

[Dianna Smith [:diannaS]]

Comment on attachment 9344711 [details]
Bug 1844213: Add accessibility.tabfocus to the dynamic pref override list r?Jamie

Approved for 116.0rc2

Comment 17

[Pulsebot]

https://hg.mozilla.org/releases/mozilla-release/rev/16c4cc571025

Comment 18

[Morgan Reschenberg [:morgan]]

(In reply to Alexandru Trif, Desktop QA [:atrif] from comment #15)

(In reply to Morgan Reschenberg [:morgan] from comment #14)

This pref didn't exist prior to the regressing bug, so it won't be in preferences in older builds.

Can you try toggling the preference, loading this test case, and tabbing through the controls?

data:text/html,<button>button</button><a href="mozilla.org">link</a><select><option>a</option><option>b</option></select>

Also, make sure you have System Settings > Keyboard > Keyboard Navigation turned off in macOS system settings

Hello! I tried reproducing the issue while having Keyboard Navigation turned off in the macOS system settings and Use the tab key to move focus between form controls and links enabled in about preferences by using the tab key to navigate on the above test case multiple times but the issue does not reproduce. The testing was performed with Firefox 117.0a1 (2023-07-18) on macOS 12 and macOS 13 ARM.
If there are other scenarios that we can try please let us know. Thank you!

Hmm, I'm not sure what else to try... We can watch the crash volume and see if it dissipates since this can't be verified manually

Comment 19

[Alexandru Trif, Desktop Test Engineering [:atrif] [PTO 15-29 Aug, please ni? :mboldan]]

(In reply to Morgan Reschenberg [:morgan] from comment #18)

Hmm, I'm not sure what else to try... We can watch the crash volume and see if it dissipates since this can't be verified manually

Thank you for your help! I'm going to remove the qe+ flag since there is nothing actionable for QA.

Comment 20

[Daniel Veditz [:dveditz]]

For Mac, it's deliberately left undefined [...]. So, I think a user has set this in about:config and now it's crashing.

And they created a string pref (user_pref("accessibility.tabfocus", "3");) instead of an integer value as expected. Only a string value should trigger this MOZ_CRASH. That was also the problem in bug 1843197

Comment 21

[Daniel Veditz [:dveditz]]

That's why testing via the UI was not able to reproduce the problem: the preferences UI correctly creates an integer pref.