Closed Bug 987026 Opened 6 years ago Closed 6 years ago

Crash when adopting a focused element [@ mozilla::a11y::FocusManager::ProcessDOMFocus]

Categories

(Core :: Disability Access APIs, defect, critical)

defect
Not set
critical

Tracking

()

VERIFIED FIXED
mozilla31
Tracking Status
firefox31 --- verified

People

(Reporter: jruderman, Assigned: surkov)

References

(Blocks 1 open bug)

Details

(Keywords: crash, testcase)

Crash Data

Attachments

(3 files)

Attached file testcase
1. Enable accessibility by pasting the following into the Browser Console:

Components.classes["@mozilla.org/accessibilityService;1"].getService(Components.interfaces.nsIAccessibleRetrieval);

2. Load the testcase.
Attachment #8395528 - Attachment description: hac.html → testcase
Attached file stack+
mozilla::a11y::FocusManager::ProcessDOMFocus derefs document, then checks whether it's null :(

This might have been introduced in bug 977170. Or maybe that patch just made the problem more obvious in the source code.
Crash Signature: [@ mozilla::a11y::FocusManager::ProcessDOMFocus] [@ mozilla::a11y::DocAccessible::GetAccessibleEvenIfNotInMap]
Attached patch patchSplinter Review
nothing to process if accessible doesn't exist. It's interesting though where the focus goes when focsued element gets adopted, presumably it should go to the document but if not it just disappears then it's rather usability bug and we don't care. I hope it doesn't open a hole for tricks though.
Assignee: nobody → surkov.alexander
Attachment #8397131 - Flags: review?(jwei)
Attachment #8397131 - Flags: review?(jwei) → review+
OS: Mac OS X → All
Hardware: x86_64 → All
I had to back this out in https://hg.mozilla.org/integration/mozilla-inbound/rev/a1223ec7312a for apparently breaking all Linux64 ASAN mochitests: https://tbpl.mozilla.org/?tree=Mozilla-Inbound&jobname=Ubuntu%20ASAN%20VM%2012.04%20x64%20mozilla-inbound%20opt%20test%20mochitest-&rev=f65515f94aab

This doesn't really make sense to me, especially with the failure that's happening in those tests, but retriggering previous pushes didn't make them fail and everything since this landed has failed. If things are still failing on this backout, I'll comment in here and you can reland this.
Flags: needinfo?(surkov.alexander)
It doesn't make sense to me because non-a11y tests were failing as well. Also I tried a try server and it was clean. Something else must be guilty.
Flags: needinfo?(surkov.alexander)
https://hg.mozilla.org/mozilla-central/rev/f65515f94aab
Status: NEW → RESOLVED
Closed: 6 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla31
Reproduced in Nightly 2014-03-25.
Verified fixed 31.0a1 (2014-03-30), Win 7 x64.
Status: RESOLVED → VERIFIED
Duplicate of this bug: 1145224
You need to log in before you can comment on or make changes to this bug.