668946 - Crash [@ nsDocAccessible::UpdateTree] with SVG, iframe

Status: RESOLVED WORKSFORME

(Core :: Disability Access APIs, defect)

Description

[Jesse Ruderman]

Attachment: testcase (requires accessibility, crashes)

1. Enable accessibility, e.g. by pasting the following into the js console:

Components.classes["@mozilla.org/accessibilityService;1"]
      .getService(Components.interfaces.nsIAccessibleRetrieval);

2. Load the testcase.

Result: Crash [@ nsDocAccessible::UpdateTree]

Comment 1

[Jesse Ruderman]

Attachment: stack trace

Comment 2

[Trevor Saunders (:tbsaunde)]

so before we crash we do

nsDocAccessible::RecreateAccessible(nsIContent* aContent)
{
  nsIContent* parentContent = aContent->GetParent();
  if (parentContent && parentContent->IsInDoc()) {
  nsINode* currNode = aNode;
  nsAccessible* accessible = nsnull;
  while (!(accessible = GetAccessible(currNode)) &&
         (currNode = currNode->GetNodeParent()));

    nsAccTreeWalker walker(mWeakShell, aChildNode,
                           aContainer->GetAllowsAnonChildAccessibles(), true);
...

so, I'm pretty sure we crash when trying to read the pointer to the vtable for nsAccessible, especially because I believe its the first element of the object in memory and the address we crash at is 0x0.

This seems to mean that although parentContent has the in document flag set in its flags bitfield we can't find a parent of the content that has an accessible.  which seems pretty odd, I'd really expect to see us find at least a document accessible.

Comment 3

[alexander :surkov (:asurkov)]

the problem here is the element triggers accessibility processing and then it's moved to inaccessible document. This particular case is easy to fix but this problem in general can lead to different kinds of crashes.

Comment 4

[alexander :surkov (:asurkov)]

Attachment: wip

while it fixes crash (though mochitest doesn't work), we should make sure here we don't rely on non empty result from GetAccessibleOrContainer where it's not safe.

Comment 5

[David Bolter [:davidb] (NeedInfo me for attention)]

(In reply to alexander :surkov from comment #3)
> the problem here is the element triggers accessibility processing and then
> it's moved to inaccessible document. This particular case is easy to fix but
> this problem in general can lead to different kinds of crashes.

Including Bug 763819 perhaps?

It would be good to tackle this class of bugs asap.

Comment 6

[Jesse Ruderman]

Attachment: updated testcase

WFM?

Comment 7

[alexander :surkov (:asurkov)]

(In reply to Jesse Ruderman from comment #6)
> Created attachment 717533 [details]
> updated testcase
> 
> WFM?

I just need to run it on trunk, right? I don't see a crash.

Comment 8

[Jesse Ruderman]

You still need the steps in comment 0.

Comment 9

[alexander :surkov (:asurkov)]

(In reply to Jesse Ruderman from comment #8)
> You still need the steps in comment 0.

same, a11y is enabled, no crash

Comment 10

[David Bolter [:davidb] (NeedInfo me for attention)]

Closing WFM based on comments 6 7 and 9.