419409 - MSAA/IAccessible2 broken in gmail

Status: RESOLVED FIXED

(Core :: Disability Access APIs, defect)

Description

[Michael Curran]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.9b4pre) Gecko/2008022404 Minefield/3.0b4pre
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.9b4pre) Gecko/2008022404 Minefield/3.0b4pre

When viewing the gmail web application in Firefox3, according to MSAA/IAccessible2: the page contains three or for iframes, and inside each of them is a quite broken accessibile object. AccRole, IAccessible2::get_windowHandle etc etc either fail or crash firefox3 when called in-process. Accessibility probe shows these problems also by showing a "NULL" node in each of the iframes. NVDA either renders a blank page or crashes firefox3, Jaws renders a page with one frame that has nothing in it. 

Reproducible: Always

Steps to Reproduce:
1. In firefox3 log in to a gmail account, and wait for the inbox etc to load.
2. With accessibility probe, locate firefox3's gmail document,  find the three or so iframes inside it, and open one of them up
3. Note what the node is inside
Actual Results:  
There is a "NULL" node (accRole and IAccessible2::role obviously failed).

Expected Results:  
Should contain the content of the iframe.

In Jaws 9, it renders a page with one frame which it calls "js", and it contains nothing. accRole usually just fails, but IAccessible2::get_windowHandle actually crashes firefox3 bringing up breakpad.

Comment 1

[Michael Curran]

A crash related to this bug, with an ID of:
7a650f3a-e392-11dc-adfe-001a4bd46e84

Comment 2

[Aaron Leventhal]

Attachment: Fix crash

Comment 3

[Marco Zehe (:MarcoZ)]

Comment on attachment 305761 [details] [diff] [review]
Fix crash

r=me

Comment 4

[Aaron Leventhal]

Comment on attachment 305761 [details] [diff] [review]
Fix crash

Mick, you may have ended up on a dead accessible. Can you check to see if it has STATE_DEFUNCT?

Comment 5

[Michael Curran]

(In reply to comment #4)
> (From update of attachment 305761 [details] [diff] [review])
> Mick, you may have ended up on a dead accessible. Can you check to see if it
> has STATE_DEFUNCT?
I can't be entirely sure with my in-process virtualBuffer library code where IAccessible2::get_windowHandle crashes whether that object has state_defunct. However, when viewing the gmail hyerarchy in Accessibility probe, in the document, I see three internal frames that all have one child which is unusable. Then there is a text object with nothing in it, then another internal frame with one child which is not usable, and then two sections which have nothing in them.
The one child that is unusable (in the internal frames)  according to accessibility probe does have state_defunct, however it also has armed, opaque, required, multiline... though I think thats accessibility probe just getting confused.
However, the point is not that that accessible is completely stuffed, but instead the fact that the internal frames  do not link properly in the hyerarchy with their subdocuments (which I assume should exist).  Also, I'm starting accessibility probe way after the page has loaded, so I'm definite all the subdocuments would have had time to load.
Note also that I was a little wrong in my original report about Jaws. Marco says that gmail works ok for him with Jaws 8, however jaws 9 and firefox3 definitely for me are not showing anything usable (just the one frame with nothing in it). Either something was changed between Jaws 8 and 9, or it could be an issue on Windows Vista... 
But the fact still remains that Accessibility probe sees the problem, and so does NVDA.

Comment 6

[Mike Beltzner [:beltzner, not reading bugmail]]

I bet this bug can be confirmed, too.

Comment 7

[Mike Beltzner [:beltzner, not reading bugmail]]

Comment on attachment 305761 [details] [diff] [review]
Fix crash

a=beltzner for 1.9

Comment 8

[Aaron Leventhal]

Checked in crash fix.

Comment 9

[Michael Curran]

It now seems that the bug is no longer an issue. gmail loads for me fine, in both NVDA and Jaws 9.  I can also report that the crashes to do with GetOwnerWindow have now stopped.  I am not sure how the iframes issue was actually fixed, though it must have been fixed indirectly when another bug was fixed.

Comment 10

[Aaron Leventhal]

I forgot we should actually mark this FIXED since we did do some work here. There were really 2 bugs -- the crash & the corruption. We fixed the crash in this bug and the corruption was probably fixed in one of our other recent cache or doc load fixes.

Comment 11

[alexander :surkov (:asurkov)]

if marked fixed then you should mention bugs

Comment 12

[Aaron Leventhal]

Cache corruption: probably fixed in bug 417249
Crash: fixed here in this bug