1977292 - Crash in [@ mozilla::a11y::Accessible::IsHyperText] [@ mozilla::a11y::Accessible::ARIARoleMap] via mozilla::a11y::TextLeafPoint::GetTextAttributesLocalAcc

Status: RESOLVED FIXED

(Core :: Disability Access APIs, defect)

Description

[James Teh [:Jamie] (away returning 14 Apr)]

Spun off bug 1977012. The top crash there, involving mozilla::a11y::IsCaretValid, was due to patches in bug 1950748. That has now been fixed. However, there are still crashes with this signature involving mozilla::a11y::TextLeafPoint::GetTextAttributesLocalAcc. This bug is to track those.

Crash report: https://crash-stats.mozilla.org/report/index/a230baff-9a0a-4c35-a59e-44e750250705

Reason: EXCEPTION_ACCESS_VIOLATION_READ

Top 10 frames of crashing thread:

0  xul.dll  mozilla::a11y::Accessible::IsHyperText const  accessible/basetypes/Accessible.h:565
0  xul.dll  mozilla::a11y::LocalAccessible::AsHyperText  accessible/generic/HyperTextAccessible.h:233
0  xul.dll  mozilla::a11y::TextLeafPoint::GetTextAttributesLocalAcc const  accessible/base/TextLeafRange.cpp:1863
1  xul.dll  mozilla::a11y::TextLeafPoint::FindTextAttrsStart const  accessible/base/TextLeafRange.cpp:1907
2  xul.dll  mozilla::a11y::GetAttribute<40015>  accessible/windows/uia/UiaTextRange.cpp:604
3  xul.dll  mozilla::a11y::UiaTextRange::GetAttributeValue  accessible/windows/uia/UiaTextRange.cpp:691
4  UIAutomationCore.DLL  ProviderCallouts::GetAttributeValue  
5  UIAutomationCore.DLL  RemotePatternStub::TextRange_GetAttributeValue  
6  UIAutomationCore.DLL  InvokePatternMethodOnCorrectContext_Callback  
7  OneCoreCommonProxyStub.dll  OneCoreCommonProxyStub.dll@0x10be  

By querying Nightly crashes reported within the last 2 months, here are some insights about the signature:

• First crash report: 2025-05-31
• Process type: Parent
• Is startup crash: No
• Has user comments: Yes
• Is null crash: Yes - all crashes happened on null or near null memory address

Comment 1

[James Teh [:Jamie] (away returning 14 Apr)]

Other relevant crash reports (i.e. before the topcrash with a different cause): ARIARoleMap, IsHyperText

Comment 2

[BugBot [:suhaib / :marco/ :calixte]]

Set release status flags based on info from the regressing bug 1950748

Comment 3

[James Teh [:Jamie] (away returning 14 Apr)]

Looking more closely at a crash dump, this is being called on a LocalAccessible for which a hide event was queued, but the event hasn't yet been fired and thus the LocalAccessible hasn't been shut down yet. That is, mParent is null and mStateFlags contains eIsNotInDocument.

Comment 4

[James Teh [:Jamie] (away returning 14 Apr)]

Attachment: Bug 1977292: GetTextAttributesLocalAcc: Handle the rare case that a client query arrives after the Accessible has been detached from the document but before it is shut down.

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/fce9be89e646
https://hg.mozilla.org/integration/autoland/rev/f9f14c97fc90
GetTextAttributesLocalAcc: Handle the rare case that a client query arrives after the Accessible has been detached from the document but before it is shut down. r=morgan

Comment 6

[Norisz Fay [:noriszfay]]

https://hg.mozilla.org/mozilla-central/rev/f9f14c97fc90