New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 903588 link

Starred by 1 user

Issue metadata

Status: Assigned
Owner:
Last visit > 30 days ago
Cc:
EstimatedDays: ----
NextAction: ----
OS: Linux , Android
Pri: 1
Type: Bug



Sign in to add a comment

a11y inspector crashes when viewing page with video

Project Member Reported by lethalantidote@chromium.org, Nov 9

Issue description

Chrome Version: 71.0.3606.0 (Developer Build) (64-bit)
OS: Linux

What steps will reproduce the problem?
(1) Visit https://mounirlamouri.github.io/sandbox/media/dynamic-controls.html
(2) Open another tab, go to chrome://accessibility
(3) Click show accessibility tree
(4) Toggle html:false to true

What is the expected result?
We should see the a11y tree.

What happens instead?
Browser crashes.


Also to be noted, if one tries to inspect the a11y information through the dev tools (by clicking inspect element, then onto the a11y pane), the a11y pane stays blank.



 
Sorry, forgot the stack

[260322:260322:1108/160713.506086:FATAL:accessibility_ui.cc(399)] Check failed: 3U == args->GetSize() (3 vs. 2)
#0 0x7fbdb8531efd base::debug::StackTrace::StackTrace()
#1 0x7fbdb8225e6a base::debug::StackTrace::StackTrace()
#2 0x7fbdb8297c4b logging::LogMessage::~LogMessage()
#3 0x5630d45f5f25 AccessibilityUIMessageHandler::RequestWebContentsTree()
#4 0x5630d45f48a6 AccessibilityUIMessageHandler::ToggleAccessibility()
#5 0x5630d2a7f3a0 _ZN4base8internal13FunctorTraitsIMN10extensions20ExtensionMessagePortEFvPN7content15RenderFrameHostEEvE6InvokeIS8_PS3_JS6_EEEvT_OT0_DpOT1_
#6 0x5630d2a7f2ff _ZN4base8internal12InvokeHelperILb0EvE8MakeItSoIRKMN10extensions20ExtensionMessagePortEFvPN7content15RenderFrameHostEEJPS5_S8_EEEvOT_DpOT0_
#7 0x5630d2a7f295 _ZN4base8internal7InvokerINS0_9BindStateIMN10extensions20ExtensionMessagePortEFvPN7content15RenderFrameHostEEJNS0_17UnretainedWrapperIS4_EEEEEFvS7_EE7RunImplIRKS9_RKNSt3__15tupleIJSB_EEEJLm0EEEEvOT_OT0_NSI_16integer_sequenceImJXspT1_EEEEOS7_
#8 0x5630d2a7f224 _ZN4base8internal7InvokerINS0_9BindStateIMN10extensions20ExtensionMessagePortEFvPN7content15RenderFrameHostEEJNS0_17UnretainedWrapperIS4_EEEEEFvS7_EE3RunEPNS0_13BindStateBaseES7_
#9 0x7fbdaff13a30 _ZNKR4base17RepeatingCallbackIFvPN7content11WebContentsEEE3RunES3_
#10 0x7fbdb2406797 content::WebUIImpl::ProcessWebUIMessage()
#11 0x7fbdb240358a content::WebUIImpl::OnWebUISend()
#12 0x7fbdb240745e _ZN3IPC20DispatchToMethodImplIN7content9WebUIImplEMS2_FvPNS1_15RenderFrameHostERKNSt3__112basic_stringIcNS5_11char_traitsIcEENS5_9allocatorIcEEEERKN4base9ListValueEES3_NS5_5tupleIJSB_SF_EEEJLm0ELm1EEEEvPT_T0_PT1_OT2_NS5_16integer_sequenceImJXspT3_EEEE
#13 0x7fbdb2407380 _ZN3IPC16DispatchToMethodIN7content9WebUIImplENS1_15RenderFrameHostEJRKNSt3__112basic_stringIcNS4_11char_traitsIcEENS4_9allocatorIcEEEERKN4base9ListValueEENS4_5tupleIJSA_SE_EEEEENS4_9enable_ifIXeqsZT1_sr3std10tuple_sizeINS4_5decayIT2_E4typeEEE5valueEvE4typeEPT_MSQ_FvPT0_DpT1_EST_OSL_
#14 0x7fbdb2407200 _ZN3IPC8MessageTI27FrameHostMsg_WebUISend_MetaNSt3__15tupleIJNS2_12basic_stringIcNS2_11char_traitsIcEENS2_9allocatorIcEEEEN4base9ListValueEEEEvE8DispatchIN7content9WebUIImplESG_NSF_15RenderFrameHostEMSG_FvPSH_RKS9_RKSB_EEEbPKNS_7MessageEPT_PT0_PT1_T2_
#15 0x7fbdb24032ac content::WebUIImpl::OnMessageReceived()
#16 0x7fbdb2330e6e content::WebContentsImpl::OnMessageReceived()
#17 0x7fbdb194b51c content::RenderFrameHostImpl::OnMessageReceived()
#18 0x7fbdb1f8c273 content::RenderProcessHostImpl::OnMessageReceived()
#19 0x7fbdb4cdd875 IPC::ChannelProxy::Context::OnDispatchMessage()
#20 0x7fbdb4ce3b0f _ZN4base8internal13FunctorTraitsIMN3IPC12ChannelProxy7ContextEFvRKNS2_7MessageEEvE6InvokeIS9_RK13scoped_refptrIS4_EJS7_EEEvT_OT0_DpOT1_
#21 0x7fbdb4ce3a6f _ZN4base8internal12InvokeHelperILb0EvE8MakeItSoIRKMN3IPC12ChannelProxy7ContextEFvRKNS4_7MessageEEJRK13scoped_refptrIS6_ES9_EEEvOT_DpOT0_
#22 0x7fbdb4ce39fd _ZN4base8internal7InvokerINS0_9BindStateIMN3IPC12ChannelProxy7ContextEFvRKNS3_7MessageEEJ13scoped_refptrIS5_ES6_EEEFvvEE7RunImplIRKSA_RKNSt3__15tupleIJSC_S6_EEEJLm0ELm1EEEEvOT_OT0_NSJ_16integer_sequenceImJXspT1_EEEE
#23 0x7fbdb4ce38fc _ZN4base8internal7InvokerINS0_9BindStateIMN3IPC12ChannelProxy7ContextEFvRKNS3_7MessageEEJ13scoped_refptrIS5_ES6_EEEFvvEE3RunEPNS0_13BindStateBaseE
#24 0x7fbdb81d542e _ZNO4base12OnceCallbackIFvvEE3RunEv
#25 0x7fbdb82274b2 base::debug::TaskAnnotator::RunTask()
#26 0x7fbdb82be746 base::MessageLoopImpl::RunTask()
#27 0x7fbdb82beace base::MessageLoopImpl::DeferOrRunPendingTask()
#28 0x7fbdb82bf229 base::MessageLoopImpl::DoWork()
#29 0x7fbdb82c422c base::MessagePumpGlib::HandleDispatch()
#30 0x7fbdb82c4981 base::(anonymous namespace)::WorkSourceDispatch()
#31 0x7fbd8b73bfc7 g_main_context_dispatch
#32 0x7fbd8b73c200 <unknown>
#33 0x7fbd8b73c28c g_main_context_iteration
#34 0x7fbdb82c431f base::MessagePumpGlib::Run()
#35 0x7fbdb82bde3b base::MessageLoopImpl::Run()
#36 0x7fbdb836913d base::RunLoop::Run()
#37 0x5630d41d91b3 ChromeBrowserMainParts::MainMessageLoopRun()
#38 0x7fbdb13d3d81 content::BrowserMainLoop::RunMainMessageLoopParts()
#39 0x7fbdb13dc3a0 content::BrowserMainRunnerImpl::Run()
#40 0x7fbdb13c63ce content::BrowserMain()
#41 0x7fbdb349ca20 content::RunBrowserProcessMain()
#42 0x7fbdb349f756 content::ContentMainRunnerImpl::Run()
#43 0x7fbdb349574c content::ContentServiceManagerMainDelegate::RunEmbedderProcess()
#44 0x7fbdb87ddc2a service_manager::Main()
#45 0x7fbdb349a143 content::ContentMain()
#46 0x5630d1b82246 ChromeMain
#47 0x5630d1b82152 main
#48 0x7fbd895b62b1 __libc_start_main
#49 0x5630d1b8202a _start


Status: Assigned (was: Untriaged)
Cc: dmazz...@chromium.org
Labels: -Pri-2 Pri-1
Currently blocked on a lot of my a11y work, as it crashes anytime I try to look at the tree :( 
Labels: OS-Android
I'm also seeing the blank a11y tree and crash on android as well. Please fix. 
Owner: jamwalla@chromium.org
On observation, it looks like we changed the requirements for arg size (2 to 3), but didnt actually add an additional argument (I assume we need to add the request_type here https://cs.chromium.org/chromium/src/chrome/browser/accessibility/accessibility_ui.cc?rcl=99a174b7b1d13e53dbb2cd3aab84ba589c862d86&l=328). I would do it myself, but I'm not exactly sure where we intend to get that request_type from. 

Assigning to jamwalla@ as it looks related to their feb241362c601e30784ef8ee9cc63c35fce0868b commit. 

Sign in to add a comment