Issue metadata
Sign in to add a comment
|
ChromeVox crashes while navigating |
||||||||||||||||||||||||
Issue descriptionReceived signal 11 SEGV_MAPERR 00000000003c #0 0x55e759f2541c base::debug::StackTrace::StackTrace() #1 0x55e759f24f91 base::debug::(anonymous namespace)::StackDumpSignalHandler() #2 0x7f61002860c0 <unknown> #3 0x55e75cf0e719 std::__1::__function::__func<>::operator()() #4 0x55e75cf0a92f extensions::(anonymous namespace)::NodeIDWrapper::Run() #5 0x55e759b3fa61 extensions::ObjectBackedNativeHandler::Router() #6 0x55e75931ab15 v8::internal::FunctionCallbackArguments::Call() #7 0x55e75931a0ed v8::internal::(anonymous namespace)::HandleApiCallHelper<>() #8 0x55e7593198c6 v8::internal::Builtin_Impl_HandleApiCall() #9 0x55e757a6c1ee <unknown> r8: 00007ffc69c55b10 r9: 0000000000000c6d r10: 00000000000031f6 r11: 0000000000000c82 r12: 00007ffc69c55e68 r13: 00001a3b13e4f320 r14: 00001a3b13bd3000 r15: 00001a3b141a3280 di: 0000000000000089 si: 0000000000000015 bp: 00007ffc69c55ad0 bx: 0000000000000000 dx: 00007ffc69c55aa4 ax: 0000000000000000 cx: 00001a3b13e52368 sp: 00007ffc69c55aa0 ip: 000055e75cf0e719 efl: 0000000000010246 cgf: 002b000000000033 erf: 0000000000000004 trp: 000000000000000e msk: 0000000000000000 cr2: 000000000000003c [end of stack trace] Calling _exit(1). Core file will not be generated.
,
Oct 4
Issue 889189 has been merged into this issue.
,
Oct 9
Issue 893396 has been merged into this issue.
,
Oct 9
Current theory: native C++ bindings are in the midst of a tree update when js makes a request (e.g. GetParent). The tree data is actually in an invalid state at this point leading to dereferencing bad memory.
,
Oct 10
+dmazzoni and +chrishall as FYI. I confirmed the issue here. The automation bindings need a better thought out threading model. I'm thinking about keeping read locks on each ax tree or on the entire set of trees. ChromeVox quickly makes calls to things like node.parent, which translates into a threaded callback on AutomationInternalCustomBindings::GetParent, which sometimes occurs while unserialization is in progress.
,
Oct 10
Behavior seen during this bug (copied over from bug 893396) ChromeVox starts to double all keypresses as seen in this sentence I tried typing: TThhiiss mmiigghhtt bbee aannootthheerr bbuugg bbuutt ssttrraannee bbeehhaavviioorr hhaappppens aa This includes ctrl + alt + z, you hear the earcon for turning off/on twice and ChromeVox can't be shut off. After a few seconds, ChromeVox starts to catch up with itself, the top ChromeVox bar appears, keystrokes are no longer duplicated, and you can turn off ChromeVox.
,
Oct 10
Possibly related to bug 894249
,
Oct 11
A possible fix was checked into 71 https://chromium.googlesource.com/chromium/src/+/210142632c6eb24d66dbd4e9a675645a4022839f @leberly, FYI. Requesting merge to 70 for the above fix.
,
Oct 11
This bug requires manual review: We are only 4 days from stable. Please contact the milestone owner if you have questions. Owners: benmason@(Android), kariahda@(iOS), geohsu@(ChromeOS), abdulsyed@(Desktop) For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
,
Oct 11
,
Oct 14
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/33c0f34ef8e2ba25f65078ca1cca21f70e4c8ab8 commit 33c0f34ef8e2ba25f65078ca1cca21f70e4c8ab8 Author: David Gunnarsson <dgunnarsson@vewd.com> Date: Sun Oct 14 13:20:38 2018 Merge to m70: Fix nullpointer crash when traversing accessibility tree TBR=dmazzoni@chromium.org Bug: 888566 Change-Id: I2a067705707646f3a2021fb7107661a2c4745bd5 Reviewed-on: https://chromium-review.googlesource.com/1243283 Commit-Queue: Dominic Mazzoni <dmazzoni@chromium.org> Reviewed-by: Dominic Mazzoni <dmazzoni@chromium.org> Cr-Original-Commit-Position: refs/heads/master@{#593974}(cherry picked from commit 210142632c6eb24d66dbd4e9a675645a4022839f) Reviewed-on: https://chromium-review.googlesource.com/c/1279955 Reviewed-by: David Tseng <dtseng@chromium.org> Cr-Commit-Position: refs/branch-heads/3538@{#995} Cr-Branched-From: 79f7c91a2b2a2932cd447fa6f865cb6662fa8fa6-refs/heads/master@{#587811} [modify] https://crrev.com/33c0f34ef8e2ba25f65078ca1cca21f70e4c8ab8/chrome/renderer/extensions/automation_internal_custom_bindings.cc
,
Oct 14
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/33c0f34ef8e2ba25f65078ca1cca21f70e4c8ab8 Commit: 33c0f34ef8e2ba25f65078ca1cca21f70e4c8ab8 Author: dgunnarsson@vewd.com Commiter: dtseng@chromium.org Date: 2018-10-14 13:20:38 +0000 UTC Merge to m70: Fix nullpointer crash when traversing accessibility tree TBR=dmazzoni@chromium.org Bug: 888566 Change-Id: I2a067705707646f3a2021fb7107661a2c4745bd5 Reviewed-on: https://chromium-review.googlesource.com/1243283 Commit-Queue: Dominic Mazzoni <dmazzoni@chromium.org> Reviewed-by: Dominic Mazzoni <dmazzoni@chromium.org> Cr-Original-Commit-Position: refs/heads/master@{#593974}(cherry picked from commit 210142632c6eb24d66dbd4e9a675645a4022839f) Reviewed-on: https://chromium-review.googlesource.com/c/1279955 Reviewed-by: David Tseng <dtseng@chromium.org> Cr-Commit-Position: refs/branch-heads/3538@{#995} Cr-Branched-From: 79f7c91a2b2a2932cd447fa6f865cb6662fa8fa6-refs/heads/master@{#587811}
,
Oct 30
Issue 894249 has been merged into this issue.
,
Nov 28
|
|||||||||||||||||||||||||
►
Sign in to add a comment |
|||||||||||||||||||||||||
Comment 1 by dtseng@chromium.org
, Oct 4