615475 - Crash [@ nsTextFrame::GetTrimmedOffsets] [@ GetTrimmableWhitespaceCount] with a11y, text wrapping

Status: RESOLVED FIXED

(Core :: Disability Access APIs, defect)

Description

[Jesse Ruderman]

Attachment: testcase (may crash Firefox when loaded)

1. Enable accessibility, e.g. by pasting the following into the js console:

Components
  .classes["@mozilla.org/accessibilityService;1"]
  .getService(Components.interfaces.nsIAccessibleRetrieval);

2. Load the testcase.

Result: Crash [@ GetTrimmableWhitespaceCount]

Comment 1

[Jesse Ruderman]

Attachment: crash log

Comment 2

[Jesse Ruderman]

bp-ca88219e-68f1-4dd8-ad4e-baf512101129 [@ nsTextFrame::GetTrimmedOffsets]

Comment 3

[Jesse Ruderman]

This may account for a topcrash, bug 612098.

Comment 4

[alexander :surkov (:asurkov)]

(In reply to comment #3)
> This may account for a topcrash, bug 612098.

I think these crashed should go away after bug 498015.

Comment 5

[David Bolter [:davidb] (NeedInfo me for attention)]

Feel free to cc Alexander and I on bug 377438 if it will help. I agree regarding bug 498015, and I've bumped the priority there. I think it should be our top priority.

Comment 6

[David Bolter [:davidb] (NeedInfo me for attention)]

Fixed via bug 498015?

Comment 7

[alexander :surkov (:asurkov)]

(In reply to comment #6)
> Fixed via bug 498015?

no

Comment 8

[David Bolter [:davidb] (NeedInfo me for attention)]

I wonder if there is some way to detect when it is unsafe for nsCSSFrameConstructor::ContentRemoved to call into us?

Comment 9

[David Bolter [:davidb] (NeedInfo me for attention)]

(Or when it is unsafe for us to get rendered text)

Comment 10

[alexander :surkov (:asurkov)]

I think a11y should cache rendered text instead
1) we can be sure AT won't call us when unsafe what may result in crashes like this
2) it allows us to make correct the text change events

Comment 11

[David Bolter [:davidb] (NeedInfo me for attention)]

Yes.

Jamie, how crucial is it that you get the text for text remove events?

Comment 12

[David Bolter [:davidb] (NeedInfo me for attention)]

(In reply to comment #10)
> I think a11y should cache rendered text instead

You filed bug 626660 for this right?

Comment 13

[alexander :surkov (:asurkov)]

(In reply to comment #12)
> (In reply to comment #10)
> > I think a11y should cache rendered text instead
> 
> You filed bug 626660 for this right?

Correct

Comment 14

[alexander :surkov (:asurkov)]

fixed by bug 630001 part1.