Closed
Bug 1990785
Opened 10 months ago
Closed 10 months ago
[Only MacOS 13][A11y]Crash only occurs when a few comments are added to a PDF in Firefox Nightly before activating VoiceOver
Categories
(Core :: Disability Access APIs, defect, P3)
Tracking
()
VERIFIED
FIXED
145 Branch
| Tracking | Status | |
|---|---|---|
| firefox-esr115 | --- | unaffected |
| firefox-esr140 | --- | fixed |
| firefox143 | --- | wontfix |
| firefox144 | --- | verified |
| firefox145 | --- | verified |
People
(Reporter: rpopovici, Assigned: morgan)
References
(Regression)
Details
(Keywords: crash, regression)
Crash Data
Attachments
(1 file)
|
48 bytes,
text/x-phabricator-request
|
diannaS
:
approval-mozilla-beta+
RyanVM
:
approval-mozilla-esr140+
|
Details | Review |
Found in:
Nightly 145.0a1(2025-09-23)
Affected versions:
Nightly 145.0a1(2025-09-23)
Tested platforms:
Affected platforms: macOS 13
Unaffected platforms: Ubuntu 24.10, Windows 10, macOS 11, mac 14 ARM
Steps to reproduce:
- Load a PDF
- Add a few comments(from Highlights, Image, Signature, Text, Draw).
- Open Voice Over.
Expected result:
VoiceOver is opened and starts reading the selected area.
Actual result:
Nightly is crashing.
Crash ID: 9b34c34d-35a0-4e17-9f1a-79a7f0250925
Signature: [@
_ZN12PLDHashTable15WithEntryHandleIZN12nsTHashtableI17nsBaseHashtableETI13nsAtomHashKeyN7mozilla7VariantIJbfdi6RefPtrI6nsAtomE8nsTArrayIiENS4_3gfx10CoordTypedINS4_8CSSPixelEfEENS4_4a11y8FontSizeENSF_5ColorENSF_11DeleteEntryENSt3__110unique_ptrI9nsTStri...
]
Regression range:
This is not a regression; it is a bug related to the new implementation of the PDF comments.
Additional notes:
This crash occurs exclusively on macOS 13 when a few comments are added to a PDF in Firefox Nightly before activating VoiceOver. If the user launches Nightly and activates VoiceOver before adding any comments to the PDF, no crashes occur.
|
Reporter | |
Updated•10 months ago
|
Summary: [Only MacOS 13]Nightly is crashing when a few comments are added to a PDF in Firefox Nightly before activating VoiceOver → [Only MacOS 13]Crash occurs when a few comments are added to a PDF in Firefox Nightly before activating VoiceOver
|
|
Reporter | |
Updated•10 months ago
|
Summary: [Only MacOS 13]Crash occurs when a few comments are added to a PDF in Firefox Nightly before activating VoiceOver → [Only MacOS 13]Crash only occurs when a few comments are added to a PDF in Firefox Nightly before activating VoiceOver
|
||
Comment 1•10 months ago
|
||
Here's the crash stack from the report:
Crash report: https://crash-stats.mozilla.org/report/index/9b34c34d-35a0-4e17-9f1a-79a7f0250925
Reason:
EXC_BAD_ACCESS / KERN_INVALID_ADDRESS
Top 10 frames:
0 XUL PLDHashTable::MakeEntryHandle(void const*, std::nothrow_t const&) xpcom/ds/PLDHashTable.cpp
0 XUL PLDHashTable::MakeEntryHandle(void const*) xpcom/ds/PLDHashTable.cpp:674
1 XUL _ZN12PLDHashTable15WithEntryHandleIZN12nsTHashtableI17nsBaseHashtableETI13nsA... xpcom/ds/PLDHashTable.h:605
2 XUL _ZN12nsTHashtableI17nsBaseHashtableETI13nsAtomHashKeyN7mozilla7VariantIJbfdi6... xpcom/ds/nsTHashtable.h:436
2 XUL _ZN15nsBaseHashtableI13nsAtomHashKeyN7mozilla7VariantIJbfdi6RefPtrI6nsAtomE8n... xpcom/ds/nsBaseHashtable.h:847
2 XUL nsBaseHashtable<nsAtomHashKey, mozilla::Variant<bool, float, double, int, Ref... xpcom/ds/nsBaseHashtable.h:477
2 XUL mozilla::a11y::AccAttributes::SetAttribute<bool>(nsAtom*, bool&&) accessible/base/AccAttributes.h:144
2 XUL mozilla::a11y::GetTextAttributes(mozilla::a11y::TextLeafPoint) accessible/mac/GeckoTextMarker.mm:439
3 XUL mozilla::a11y::GeckoTextMarkerRange::AttributedText() const accessible/mac/GeckoTextMarker.mm:483
4 XUL -[MOXTextMarkerDelegate moxAttributedStringForTextMarkerRange:] accessible/mac/MOXTextMarkerDelegate.mm:423
:Jamie, could you have a look please ?
Crash Signature: [@ _ZN12PLDHashTable15WithEntryHandleIZN12nsTHashtableI17nsBaseHashtableETI13nsAtomHashKeyN7mozilla7VariantIJbfdi6RefPtrI6nsAtomE8nsTArrayIiENS4_3gfx10CoordTypedINS4_8CSSPixelEfEENS4_4a11y8FontSizeENSF_5ColorENSF_11DeleteEntryENSt3__110unique_ptrI9nsTStri…
Flags: needinfo?(jteh)
|
|
Reporter | |
Updated•10 months ago
|
Crash Signature: [@ _ZN12PLDHashTable15WithEntryHandleIZN12nsTHashtableI17nsBaseHashtableETI13nsAtomHashKeyN7mozilla7VariantIJbfdi6RefPtrI6nsAtomE8nsTArrayIiENS4_3gfx10CoordTypedINS4_8CSSPixelEfEENS4_4a11y8FontSizeENSF_5ColorENSF_11DeleteEntryENSt3__110unique_ptrI9nsTStri…
Keywords: access
Summary: [Only MacOS 13]Crash only occurs when a few comments are added to a PDF in Firefox Nightly before activating VoiceOver → [Only MacOS 13][A11y]Crash only occurs when a few comments are added to a PDF in Firefox Nightly before activating VoiceOver
|
|
||
Updated•10 months ago
|
Crash Signature: [@ _ZN12PLDHashTable15WithEntryHandleIZN12nsTHashtableI17nsBaseHashtableETI13nsAtomHashKeyN7mozilla7VariantIJbfdi6RefPtrI6nsAtomE8nsTArrayIiENS4_3gfx10CoordTypedINS4_8CSSPixelEfEENS4_4a11y8FontSizeENSF_5ColorENSF_11DeleteEntryENSt3__110unique_ptrI9nsTStri…
|
||
Comment 2•10 months ago
|
||
gsvelto, it looks like the symbol demangler is having some trouble with this one. Is that a crash reporter issue or a Socorro issue?
Flags: needinfo?(gsvelto)
|
||
Comment 3•10 months ago
•
|
||
It's an issue in the symbolic-demangler crate that dump_syms uses to spit out these symbols. We're not on the latest version of the crate but I haven't seen any fix in the last few versions that might affect this, so I assume that even the latest symbolic-demangler crate would get it wrong. cxxfilt spits out the following:
std::__1::invoke_result<mozilla::detail::AsVariantTemporary<bool>, PLDHashTable::EntryHandle&&>::type PLDHashTable::WithEntryHandle<std::__1::invoke_result<mozilla::detail::AsVariantTemporary<bool>, nsTHashtable<nsBaseHashtableET<nsAtomHashKey, mozilla::Variant<bool, float, double, int, RefPtr<nsAtom>, nsTArray<int>, mozilla::gfx::CoordTyped<mozilla::CSSPixel, float>, mozilla::a11y::FontSize, mozilla::a11y::Color, mozilla::a11y::DeleteEntry, std::__1::unique_ptr<nsTString<char16_t>, std::__1::default_delete<nsTString<char16_t>>>, RefPtr<mozilla::a11y::AccAttributes>, unsigned long long, std::__1::unique_ptr<mozilla::a11y::AccGroupInfo, std::__1::default_delete<mozilla::a11y::AccGroupInfo>>, std::__1::unique_ptr<mozilla::gfx::Matrix4x4Typed<mozilla::gfx::UnknownUnits, mozilla::gfx::UnknownUnits, float>, std::__1::default_delete<mozilla::gfx::Matrix4x4Typed<mozilla::gfx::UnknownUnits, mozilla::gfx::UnknownUnits, float>>>, nsTArray<unsigned long long>, nsTArray<mozilla::a11y::TextOffsetAttribute>, mozilla::WritingMode>>>::EntryHandle&&>::type nsTHashtable<nsBaseHashtableET<nsAtomHashKey, mozilla::Variant<bool, float, double, int, RefPtr<nsAtom>, nsTArray<int>, mozilla::gfx::CoordTyped<mozilla::CSSPixel, float>, mozilla::a11y::FontSize, mozilla::a11y::Color, mozilla::a11y::DeleteEntry, std::__1::unique_ptr<nsTString<char16_t>, std::__1::default_delete<nsTString<char16_t>>>, RefPtr<mozilla::a11y::AccAttributes>, unsigned long long, std::__1::unique_ptr<mozilla::a11y::AccGroupInfo, std::__1::default_delete<mozilla::a11y::AccGroupInfo>>, std::__1::unique_ptr<mozilla::gfx::Matrix4x4Typed<mozilla::gfx::UnknownUnits, mozilla::gfx::UnknownUnits, float>, std::__1::default_delete<mozilla::gfx::Matrix4x4Typed<mozilla::gfx::UnknownUnits, mozilla::gfx::UnknownUnits, float>>>, nsTArray<unsigned long long>, nsTArray<mozilla::a11y::TextOffsetAttribute>, mozilla::WritingMode>>>::WithEntryHandle<std::__1::invoke_result<mozilla::detail::AsVariantTemporary<bool>, nsBaseHashtable<nsAtomHashKey, mozilla::Variant<bool, float, double, int, RefPtr<nsAtom>, nsTArray<int>, mozilla::gfx::CoordTyped<mozilla::CSSPixel, float>, mozilla::a11y::FontSize, mozilla::a11y::Color, mozilla::a11y::DeleteEntry, std::__1::unique_ptr<nsTString<char16_t>, std::__1::default_delete<nsTString<char16_t>>>, RefPtr<mozilla::a11y::AccAttributes>, unsigned long long, std::__1::unique_ptr<mozilla::a11y::AccGroupInfo, std::__1::default_delete<mozilla::a11y::AccGroupInfo>>, std::__1::unique_ptr<mozilla::gfx::Matrix4x4Typed<mozilla::gfx::UnknownUnits, mozilla::gfx::UnknownUnits, float>, std::__1::default_delete<mozilla::gfx::Matrix4x4Typed<mozilla::gfx::UnknownUnits, mozilla::gfx::UnknownUnits, float>>>, nsTArray<unsigned long long>, nsTArray<mozilla::a11y::TextOffsetAttribute>, mozilla::WritingMode>, mozilla::Variant<bool, float, double, int, RefPtr<nsAtom>, nsTArray<int>, mozilla::gfx::CoordTyped<mozilla::CSSPixel, float>, mozilla::a11y::FontSize, mozilla::a11y::Color, mozilla::a11y::DeleteEntry, std::__1::unique_ptr<nsTString<char16_t>, std::__1::default_delete<nsTString<char16_t>>>, RefPtr<mozilla::a11y::AccAttributes>, unsigned long long, std::__1::unique_ptr<mozilla::a11y::AccGroupInfo, std::__1::default_delete<mozilla::a11y::AccGroupInfo>>, std::__1::unique_ptr<mozilla::gfx::Matrix4x4Typed<mozilla::gfx::UnknownUnits, mozilla::gfx::UnknownUnits, float>, std::__1::default_delete<mozilla::gfx::Matrix4x4Typed<mozilla::gfx::UnknownUnits, mozilla::gfx::UnknownUnits, float>>>, nsTArray<unsigned long long>, nsTArray<mozilla::a11y::TextOffsetAttribute>, mozilla::WritingMode>, nsDefaultConverter<mozilla::Variant<bool, float, double, int, RefPtr<nsAtom>, nsTArray<int>, mozilla::gfx::CoordTyped<mozilla::CSSPixel, float>, mozilla::a11y::FontSize, mozilla::a11y::Color, mozilla::a11y::DeleteEntry, std::__1::unique_ptr<nsTString<char16_t>, std::__1::default_delete<nsTString<char16_t>>>, RefPtr<mozilla::a11y::AccAttributes>, unsigned long long, std::__1::unique_ptr<mozilla::a11y::AccGroupInfo, std::__1::default_delete<mozilla::a11y::AccGroupInfo>>, std::__1::unique_ptr<mozilla::gfx::Matrix4x4Typed<mozilla::gfx::UnknownUnits, mozilla::gfx::UnknownUnits, float>, std::__1::default_delete<mozilla::gfx::Matrix4x4Typed<mozilla::gfx::UnknownUnits, mozilla::gfx::UnknownUnits, float>>>, nsTArray<unsigned long long>, nsTArray<mozilla::a11y::TextOffsetAttribute>, mozilla::WritingMode>, mozilla::Variant<bool, float, double, int, RefPtr<nsAtom>, nsTArray<int>, mozilla::gfx::CoordTyped<mozilla::CSSPixel, float>, mozilla::a11y::FontSize, mozilla::a11y::Color, mozilla::a11y::DeleteEntry, std::__1::unique_ptr<nsTString<char16_t>, std::__1::default_delete<nsTString<char16_t>>>, RefPtr<mozilla::a11y::AccAttributes>, unsigned long long, std::__1::unique_ptr<mozilla::a11y::AccGroupInfo, std::__1::default_delete<mozilla::a11y::AccGroupInfo>>, std::__1::unique_ptr<mozilla::gfx::Matrix4x4Typed<mozilla::gfx::UnknownUnits, mozilla::gfx::UnknownUnits, float>, std::__1::default_delete<mozilla::gfx::Matrix4x4Typed<mozilla::gfx::UnknownUnits, mozilla::gfx::UnknownUnits, float>>>, nsTArray<unsigned long long>, nsTArray<mozilla::a11y::TextOffsetAttribute>, mozilla::WritingMode>>>::EntryHandle&&>::type nsBaseHashtable<nsAtomHashKey, mozilla::Variant<bool, float, double, int, RefPtr<nsAtom>, nsTArray<int>, mozilla::gfx::CoordTyped<mozilla::CSSPixel, float>, mozilla::a11y::FontSize, mozilla::a11y::Color, mozilla::a11y::DeleteEntry, std::__1::unique_ptr<nsTString<char16_t>, std::__1::default_delete<nsTString<char16_t>>>, RefPtr<mozilla::a11y::AccAttributes>, unsigned long long, std::__1::unique_ptr<mozilla::a11y::AccGroupInfo, std::__1::default_delete<mozilla::a11y::AccGroupInfo>>, std::__1::unique_ptr<mozilla::gfx::Matrix4x4Typed<mozilla::gfx::UnknownUnits, mozilla::gfx::UnknownUnits, float>, std::__1::default_delete<mozilla::gfx::Matrix4x4Typed<mozilla::gfx::UnknownUnits, mozilla::gfx::UnknownUnits, float>>>, nsTArray<unsigned long long>, nsTArray<mozilla::a11y::TextOffsetAttribute>, mozilla::WritingMode>, mozilla::Variant<bool, float, double, int, RefPtr<nsAtom>, nsTArray<int>, mozilla::gfx::CoordTyped<mozilla::CSSPixel, float>, mozilla::a11y::FontSize, mozilla::a11y::Color, mozilla::a11y::DeleteEntry, std::__1::unique_ptr<nsTString<char16_t>, std::__1::default_delete<nsTString<char16_t>>>, RefPtr<mozilla::a11y::AccAttributes>, unsigned long long, std::__1::unique_ptr<mozilla::a11y::AccGroupInfo, std::__1::default_delete<mozilla::a11y::AccGroupInfo>>, std::__1::unique_ptr<mozilla::gfx::Matrix4x4Typed<mozilla::gfx::UnknownUnits, mozilla::gfx::UnknownUnits, float>, std::__1::default_delete<mozilla::gfx::Matrix4x4Typed<mozilla::gfx::UnknownUnits, mozilla::gfx::UnknownUnits, float>>>, nsTArray<unsigned long long>, nsTArray<mozilla::a11y::TextOffsetAttribute>, mozilla::WritingMode>, nsDefaultConverter<mozilla::Variant<bool, float, double, int, RefPtr<nsAtom>, nsTArray<int>, mozilla::gfx::CoordTyped<mozilla::CSSPixel, float>, mozilla::a11y::FontSize, mozilla::a11y::Color, mozilla::a11y::DeleteEntry, std::__1::unique_ptr<nsTString<char16_t>, std::__1::default_delete<nsTString<char16_t>>>, RefPtr<mozilla::a11y::AccAttributes>, unsigned long long, std::__1::unique_ptr<mozilla::a11y::AccGroupInfo, std::__1::default_delete<mozilla::a11y::AccGroupInfo>>, std::__1::unique_ptr<mozilla::gfx::Matrix4x4Typed<mozilla::gfx::UnknownUnits, mozilla::gfx::UnknownUnits, float>, std::__1::default_delete<mozilla::gfx::Matrix4x4Typed<mozilla::gfx::UnknownUnits, mozilla::gfx::UnknownUnits, float>>>, nsTArray<unsigned long long>, nsTArray<mozilla::a11y::TextOffsetAttribute>, mozilla::WritingMode>, mozilla::Variant<bool, float, double, int, RefPtr<nsAtom>, nsTArray<int>, mozilla::gfx::CoordTyped<mozilla::CSSPixel, float>, mozilla::a11y::FontSize, mozilla::a11y::Color, mozilla::a11y::DeleteEntry, std::__1::unique_ptr<nsTString<char16_t>, std::__1::default_delete<nsTString<char16_t>>>, RefPtr<mozilla::a11y::AccAttributes>, unsigned long long, std::__1::unique_ptr<mozilla::a11y::AccGroupInfo, std::__1::default_delete<mozilla::a11y::AccGroupInfo>>, std::__1::unique_ptr<mozilla::gfx::Matrix4x4Typed<mozilla::gfx::UnknownUnits, mozilla::gfx::UnknownUnits, float>, std::__1::default_delete<mozilla::gfx::Matrix4x4Typed<mozilla::gfx::UnknownUnits, mozilla::gfx::UnknownUnits, float>>>, nsTArray<unsigned long long>, nsTArray<mozilla::a11y::TextOffsetAttribute>, mozilla::WritingMode>>>::WithEntryHandle<mozilla::Variant<bool, float, double, int, RefPtr<nsAtom>, nsTArray<int>, mozilla::gfx::CoordTyped<mozilla::CSSPixel, float>, mozilla::a11y::FontSize, mozilla::a11y::Color, mozilla::a11y::DeleteEntry, std::__1::unique_ptr<nsTString<char16_t>, std::__1::default_delete<nsTString<char16_t>>>, RefPtr<mozilla::a11y::AccAttributes>, unsigned long long, std::__1::unique_ptr<mozilla::a11y::AccGroupInfo, std::__1::default_delete<mozilla::a11y::AccGroupInfo>>, std::__1::unique_ptr<mozilla::gfx::Matrix4x4Typed<mozilla::gfx::UnknownUnits, mozilla::gfx::UnknownUnits, float>, std::__1::default_delete<mozilla::gfx::Matrix4x4Typed<mozilla::gfx::UnknownUnits, mozilla::gfx::UnknownUnits, float>>>, nsTArray<unsigned long long>, nsTArray<mozilla::a11y::TextOffsetAttribute>, mozilla::WritingMode>& nsBaseHashtable<nsAtomHashKey, mozilla::Variant<bool, float, double, int, RefPtr<nsAtom>, nsTArray<int>, mozilla::gfx::CoordTyped<mozilla::CSSPixel, float>, mozilla::a11y::FontSize, mozilla::a11y::Color, mozilla::a11y::DeleteEntry, std::__1::unique_ptr<nsTString<char16_t>, std::__1::default_delete<nsTString<char16_t>>>, RefPtr<mozilla::a11y::AccAttributes>, unsigned long long, std::__1::unique_ptr<mozilla::a11y::AccGroupInfo, std::__1::default_delete<mozilla::a11y::AccGroupInfo>>, std::__1::unique_ptr<mozilla::gfx::Matrix4x4Typed<mozilla::gfx::UnknownUnits, mozilla::gfx::UnknownUnits, float>, std::__1::default_delete<mozilla::gfx::Matrix4x4Typed<mozilla::gfx::UnknownUnits, mozilla::gfx::UnknownUnits, float>>>, nsTArray<unsigned long long>, nsTArray<mozilla::a11y::TextOffsetAttribute>, mozilla::WritingMode>, mozilla::Variant<bool, float, double, int, RefPtr<nsAtom>, nsTArray<int>, mozilla::gfx::CoordTyped<mozilla::CSSPixel, float>, mozilla::a11y::FontSize, mozilla::a11y::Color, mozilla::a11y::DeleteEntry, std::__1::unique_ptr<nsTString<char16_t>, std::__1::default_delete<nsTString<char16_t>>>, RefPtr<mozilla::a11y::AccAttributes>, unsigned long long, std::__1::unique_ptr<mozilla::a11y::AccGroupInfo, std::__1::default_delete<mozilla::a11y::AccGroupInfo>>, std::__1::unique_ptr<mozilla::gfx::Matrix4x4Typed<mozilla::gfx::UnknownUnits, mozilla::gfx::UnknownUnits, float>, std::__1::default_delete<mozilla::gfx::Matrix4x4Typed<mozilla::gfx::UnknownUnits, mozilla::gfx::UnknownUnits, float>>>, nsTArray<unsigned long long>, nsTArray<mozilla::a11y::TextOffsetAttribute>, mozilla::WritingMode>, nsDefaultConverter<mozilla::Variant<bool, float, double, int, RefPtr<nsAtom>, nsTArray<int>, mozilla::gfx::CoordTyped<mozilla::CSSPixel, float>, mozilla::a11y::FontSize, mozilla::a11y::Color, mozilla::a11y::DeleteEntry, std::__1::unique_ptr<nsTString<char16_t>, std::__1::default_delete<nsTString<char16_t>>>, RefPtr<mozilla::a11y::AccAttributes>, unsigned long long, std::__1::unique_ptr<mozilla::a11y::AccGroupInfo, std::__1::default_delete<mozilla::a11y::AccGroupInfo>>, std::__1::unique_ptr<mozilla::gfx::Matrix4x4Typed<mozilla::gfx::UnknownUnits, mozilla::gfx::UnknownUnits, float>, std::__1::default_delete<mozilla::gfx::Matrix4x4Typed<mozilla::gfx::UnknownUnits, mozilla::gfx::UnknownUnits, float>>>, nsTArray<unsigned long long>, nsTArray<mozilla::a11y::TextOffsetAttribute>, mozilla::WritingMode>, mozilla::Variant<bool, float, double, int, RefPtr<nsAtom>, nsTArray<int>, mozilla::gfx::CoordTyped<mozilla::CSSPixel, float>, mozilla::a11y::FontSize, mozilla::a11y::Color, mozilla::a11y::DeleteEntry, std::__1::unique_ptr<nsTString<char16_t>, std::__1::default_delete<nsTString<char16_t>>>, RefPtr<mozilla::a11y::AccAttributes>, unsigned long long, std::__1::unique_ptr<mozilla::a11y::AccGroupInfo, std::__1::default_delete<mozilla::a11y::AccGroupInfo>>, std::__1::unique_ptr<mozilla::gfx::Matrix4x4Typed<mozilla::gfx::UnknownUnits, mozilla::gfx::UnknownUnits, float>, std::__1::default_delete<mozilla::gfx::Matrix4x4Typed<mozilla::gfx::UnknownUnits, mozilla::gfx::UnknownUnits, float>>>, nsTArray<unsigned long long>, nsTArray<mozilla::a11y::TextOffsetAttribute>, mozilla::WritingMode>>>::InsertOrUpdate<mozilla::detail::AsVariantTemporary<bool>>(nsAtom*, mozilla::detail::AsVariantTemporary<bool>&&)::'lambda'(mozilla::detail::AsVariantTemporary<bool>)>(nsAtom*, mozilla::detail::AsVariantTemporary<bool>&&)::'lambda'(mozilla::detail::AsVariantTemporary<bool>)>(nsAtom*, mozilla::detail::AsVariantTemporary<bool>&&)::'lambda'(mozilla::detail::AsVariantTemporary<bool>)>(void const*, mozilla::detail::AsVariantTemporary<bool>&&)
... which is quite the symbol, but not the largest I've seen. I'll dig through the various crates and see to which one this bug belongs to, then file it upstream.
|
|
||
Updated•10 months ago
|
Flags: needinfo?(gsvelto)
|
||
Comment 4•10 months ago
|
||
This crash looks like it is happening in the a11y module.
Severity: S3 → S2
Component: PDF Viewer → Disability Access APIs
Product: Firefox → Core
|
|
||
Updated•10 months ago
|
Priority: -- → P3
|
||
Comment 5•10 months ago
|
||
Is it common for users to enable VoiceOver after starting to use a feature?
|
||
Comment 6•10 months ago
|
||
I think this is because we get text attributes here, but don't null check it and then try to insert into it here. When we get attributes, we should return null if attributes is null.
Flags: needinfo?(jteh)
|
|
||
Updated•10 months ago
|
Keywords: crash,
regression
Regressed by: 1932980
|
Assignee | |
Updated•10 months ago
|
Assignee: nobody → mreschenberg
|
|
Assignee | |
Comment 7•10 months ago
|
||
I can take this. Thanks for investigating, Jamie :)
|
|
||
Comment 8•10 months ago
|
||
Thanks Morgan. I was going to try to whip up a patch today in the few hours I have before PTO, but you taking it is much more sensible. :)
|
|
||
Comment 9•10 months ago
|
||
Just to document my thinking, I also considered creating an AccAttributes if TextLeafPoint::GetTextAttributes returns null. That way, we'd still communicate the mark attribute from the ancestor. However, I realised we don't want to do that because we have special AXAttachment handling for non-text objects and we use null attributes to trigger that.
|
|
||
Comment 10•10 months ago
|
||
(In reply to Marco Castelluccio [:marco] from comment #5)
Is it common for users to enable VoiceOver after starting to use a feature?
It likely depends on the needs of the user. It's not so likely for a totally blind user, but might be more common for a user with some vision. But even a totally blind user working alongside a sighted person might hit this.
|
|
Assignee | |
Comment 11•10 months ago
|
||
|
|
Assignee | |
Comment 12•10 months ago
|
||
(In reply to James Teh [:Jamie] from comment #9)
Just to document my thinking, I also considered creating an AccAttributes if TextLeafPoint::GetTextAttributes returns null. That way, we'd still communicate the mark attribute from the ancestor. However, I realised we don't want to do that because we have special AXAttachment handling for non-text objects and we use null attributes to trigger that.
Aha, this is good to know -- I've documented it in a comment in the patch.
|
||
Comment 13•10 months ago
|
||
Set release status flags based on info from the regressing bug 1932980
status-firefox143:
--- → affected
status-firefox144:
--- → affected
status-firefox-esr140:
--- → affected
|
|
Assignee | |
Comment 14•10 months ago
|
||
|
||
Updated•10 months ago
|
|
||
Comment 15•10 months ago
|
||
Pushed by mreschenberg@mozilla.com:
https://github.com/mozilla-firefox/firefox/commit/fafdf7c7f6c3
https://hg.mozilla.org/integration/autoland/rev/884397f54a40
Verify text attributes exist before adding to them r=Jamie
|
||
Comment 16•10 months ago
|
||
| bugherder | ||
Status: NEW → RESOLVED
Closed: 10 months ago
Resolution: --- → FIXED
Target Milestone: --- → 145 Branch
|
|
||
Comment 17•10 months ago
|
||
The patch landed in nightly and beta is affected.
:morgan, is this bug important enough to require an uplift?
- If yes, please nominate the patch for beta approval.
- See https://wiki.mozilla.org/Release_Management/Requesting_an_Uplift for documentation on how to request an uplift.
- If no, please set
status-firefox144towontfix.
For more information, please visit BugBot documentation.
Flags: needinfo?(mreschenberg)
|
|
Assignee | |
Comment 18•10 months ago
|
||
Comment on attachment 9517357 [details]
Bug 1990785: Verify text attributes exist before adding to them r?eeejay,Jamie
Beta/Release Uplift Approval Request
- User impact if declined/Reason for urgency: VoiceOver users will continue to experience a Firefox crash if this patch is not uplifted.
- Is this code covered by automated tests?: Yes
- Has the fix been verified in Nightly?: Yes
- Needs manual test from QE?: No
- If yes, steps to reproduce:
- List of other uplifts needed: None
- Risk to taking this patch: Low
- Why is the change risky/not risky? (and alternatives if risky): This patch introduces a null check and early return, it is also covered by automatic testing.
- String changes made/needed: N/A
- Is Android affected?: No
Flags: needinfo?(mreschenberg)
Attachment #9517357 -
Flags: approval-mozilla-beta?
|
|
Assignee | |
Comment 19•10 months ago
|
||
Comment on attachment 9517357 [details]
Bug 1990785: Verify text attributes exist before adding to them r?eeejay,Jamie
ESR Uplift Approval Request
- If this is not a sec:{high,crit} bug, please state case for ESR consideration: VoiceOver users currently experience a Firefox crash
- User impact if declined: Users will continue to experience this crash when interacting with <mark> elements. This happens, for example, when creating and editing PDF comments for highlighted regions, and on HTML pages.
- Fix Landed on Version: 145
- Risk to taking this patch: Low
- Why is the change risky/not risky? (and alternatives if risky): This patch introduces a null check and is covered by automated testing.
Attachment #9517357 -
Flags: approval-mozilla-esr140?
|
||
Comment 20•10 months ago
|
||
Comment on attachment 9517357 [details]
Bug 1990785: Verify text attributes exist before adding to them r?eeejay,Jamie
Approved for 144.0b9
Attachment #9517357 -
Flags: approval-mozilla-beta? → approval-mozilla-beta+
|
|
||
Updated•10 months ago
|
|
|
||
Comment 21•10 months ago
|
||
| uplift | ||
|
|
||
Updated•10 months ago
|
Flags: in-testsuite+
|
|
||
Comment 22•10 months ago
|
||
Comment on attachment 9517357 [details]
Bug 1990785: Verify text attributes exist before adding to them r?eeejay,Jamie
Approved for 140.4esr.
Attachment #9517357 -
Flags: approval-mozilla-esr140? → approval-mozilla-esr140+
|
|
||
Updated•10 months ago
|
|
|
||
Comment 23•10 months ago
|
||
| uplift | ||
|
|
Reporter | |
Comment 24•10 months ago
|
||
Verified as fixed in Nightly 145.0a1(2025-10-06) using MacOS 13.2.1. Waiting for the 144.0 and 140.4 ESR builds.
|
|
Reporter | |
Updated•10 months ago
|
|
|
Reporter | |
Comment 25•10 months ago
•
|
||
Verified as fixed in RC 144.0 using macOS 13.2.1. Crash doesn't occur.
I cannot enable the PDF commenting feature on ESR 140.4 to check if the crash reproduces or not.
|
|
Reporter | |
Updated•10 months ago
|
|
|
Reporter | |
Comment 26•10 months ago
•
|
||
The PDF Commenting feature is not available in ESR v140.4.0, so the crash reported cannot be reproduced in this version.
I assume the fix was pushed to this version if ever the feature was uplifted to ESR 140.4.
I will change the status of the issue to 'Verified Fixed'.
Status: RESOLVED → VERIFIED
You need to log in
before you can comment on or make changes to this bug.
Description
•