1904256 - Crash in [@ mozilla::StaticPrefs::accessibility_tabfocus] with JAWS

Status: NEW

(Thunderbird :: Disability Access, defect)

Description

[Wayne Mery (:wsmwk)]

Looks like just a single user, whose crashes started with 127.0b2 https://crash-stats.mozilla.org/signature/?product=Thunderbird&signature=mozilla%3A%3AStaticPrefs%3A%3Aaccessibility_tabfocus&date=%3E%3D2023-12-23T17%3A08%3A00.000Z&date=%3C2024-06-23T17%3A08%3A00.000Z. Not a startup crash.

Crash report: https://crash-stats.mozilla.org/report/index/c90aec3b-9d5e-44f0-9a28-446cd0240623

MOZ_CRASH Reason: MOZ_DIAGNOSTIC_ASSERT(IsAtomic<int32_t>::value || NS_IsMainThread()) (Non-atomic static pref 'accessibility.tabfocus' being accessed on background thread by getter)

Top 10 frames:

0  xul.dll  mozilla::StaticPrefs::accessibility_tabfocus()  modules/libpref/init/StaticPrefList_accessibility.h:3
0  xul.dll  mozilla::FocusModel::IsTabFocusable(mozilla::TabFocusableType)  dom/base/FocusModel.h:36
0  xul.dll  mozilla::dom::HTMLAnchorElement::IsHTMLFocusable(mozilla::IsFocusableFlags, b...  dom/html/HTMLAnchorElement.cpp:122
1  xul.dll  nsGenericHTMLElement::IsFocusableWithoutStyle(mozilla::IsFocusableFlags)  dom/html/nsGenericHTMLElement.h:347
2  xul.dll  nsIFrame::IsFocusable(mozilla::IsFocusableFlags)  layout/generic/nsIFrame.cpp:10838
3  xul.dll  mozilla::a11y::LocalAccessible::NativeInteractiveState() const  accessible/generic/LocalAccessible.cpp:431
4  xul.dll  mozilla::a11y::HTMLLinkAccessible::NativeInteractiveState() const  accessible/html/HTMLLinkAccessible.cpp:57
5  xul.dll  mozilla::a11y::LocalAccessible::NativeState() const  accessible/generic/LocalAccessible.cpp:384
6  xul.dll  mozilla::a11y::HyperTextAccessible::NativeState() const  accessible/generic/HyperTextAccessible.cpp:68
7  xul.dll  mozilla::a11y::HTMLLinkAccessible::NativeState() const  accessible/html/HTMLLinkAccessible.cpp:37

Comment 1

[James Teh [:Jamie]]

Once again, JAWS accessing Gecko from the file dialog thread when it shouldn't. I had hoped bug 1896816 would fix this kind of bad client behaviour, but I guess JAWS is poking a reference it obtained on the other thread and thus isn't calling QueryInterface.