1965405 - Hang when erasing text in a text box at the end of a document with Narrator

Status: VERIFIED FIXED

(Core :: Disability Access APIs, defect)

Description

[James Teh [:Jamie] (away returning 14 Apr)]

STR (with Narrator):

1. Open this test case:
   data:text/html,a<input value="bc">
2. Tab to the input.
3. Press end to move the cursor to the end of the input.
4. Press backspace.
   • Expected: "c" should be erased and Narrator should say "c"
   • Actual: Firefox hangs and stops responding forever.

Comment 1

[James Teh [:Jamie] (away returning 14 Apr)]

We're getting stuck in an infinite loop in GetAttributeValue trying to retrieve the UIA ReadOnly text attribute. I'm not yet sure whether UIA is calling us in a loop or whether we're getting stuck in a loop ourselves. I'm hoping the latter, as the former will be a lot harder to track down.

Comment 2

[Alice0775 White]

I can reproduce the issue on Nigitly140.0a1 Windows11.

Regression window:
https://hg-edge.mozilla.org/integration/autoland/pushloghtml?fromchange=a1f873bd67b54fbf44f16c45947f7ba8ea4ed4fb&tochange=e10738fac39721b5820e5383520230831c6e0a7c

Comment 3

[BugBot [:suhaib / :marco/ :calixte]]

Set release status flags based on info from the regressing bug 1957314

Comment 4

[James Teh [:Jamie] (away returning 14 Apr)]

Attachment: Bug 1965405: When reconstituting a TextLeafRange for a UiaTextRange, restrict offsets to the current lengths of Accessibles.

This is the scenario for this bug:

1. A UIA client retrieved a range for the caret at the end of a text input at the end of a document, collapsed at (input, 2).
2. Backspace was pressed, removing the last character, so (input, 2) was no longer valid.
3. The UIA client attempted to call GetAttributeValue on the previously fetched range.
4. FindTextAttrsStart couldn't move further, so it returned the document end point, (input, 1).
5. Because the range contained (input, 2), the search point was never less than the end point, so we got stuck in an infinite loop in GetAttributeValue.

To fix this, UiaTextRange now restricts offsets to the length of the leaf Accessibles when reconstructing the TextLeafRange.

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/a8f93bb27d15
When reconstituting a TextLeafRange for a UiaTextRange, restrict offsets to the current lengths of Accessibles. r=morgan

Comment 6

[amarc]

https://hg.mozilla.org/mozilla-central/rev/a8f93bb27d15

Comment 7

[Bianca Hidecuti, Desktop Test Engineering [:bhidecuti]]

I was able to reproduce the issue with Firefox Nightly 140.0a (2025-05-08), on Windows 11, as described in Comment 0.
Verified as fixed using Firefox 140.0b2 (with the "accessibility.uia.enable" pref set to "2") and Firefox Nightly 141.0a1 (2025-05-27), on Windows 11. The hang is no longer occurring when erasing text in a text box at the end of a document with Narrator.