Accessibility crash while closing tabs or restoring a session

[iefremov]

Browser crash https://brave.sp.backtrace.io/p/brave/debug?filters=((callstack%2Ccontains%2CaccessibilityAttributedStringForRange)%2C(ver%2Cregex%2C%228%5B7%7C8%7C9%5D.*%22)%2Cptype%3Dbrowser)&debug=(c25f28,0,0)

[ 05 ] std::__terminate(void (*)())
[ 06 ] __cxxabiv1::failed_throw(__cxxabiv1::__cxa_exception*)
[ 07 ] __cxa_throw
[ 08 ] 0x7fff6ca756ed
[ 09 ] 0x7fff3625b33c
[ 10 ] -[AXPlatformNodeCocoa accessibilityAttributedStringForRange:]

Steps to Reproduce

1. System preferences -> Accessibility -> Keyboard -> Enable Typing feedback
2. Login to GMail, open second tab (Cmd-T) with gmail, close it (Cmd-W). Sometimes you need to open several tabs with GMail and quickly close them one by one
3. Observe a crash
4. Restart a browser, try to restore tabs
5. Observe a crash

Reproduces how often:

Easily reproduced/Intermittent issue/No steps to reproduce

Brave version (brave://version info)

Brave	1.19.86 Chromium: 88.0.4324.96 (Official Build) (x86_64)
Revision	68dba2d8a0b149a1d3afac56fa74648032bcf46b-refs/branch-heads/4324@{#1784}
OS	macOS Version 10.15.7 (Build 19H114)

and newer, tested on

Brave	1.21.28 Chromium: 88.0.4324.96 (Official Build) nightly (x86_64)
Revision	68dba2d8a0b149a1d3afac56fa74648032bcf46b-refs/branch-heads/4324@{#1784}
OS	macOS Version 10.15.7 (Build 19H114)

Version/Channel Information:

• Can you reproduce this issue with the current release? yes
• Can you reproduce this issue with the beta channel? yes
• Can you reproduce this issue with the nightly channel? yes

Technical notes

The crash occurs in accessibilityAttributedStringForRange which is called by MacOS for different elements of the browser UI. For some reason, MacOS calls it for Tabs, and in this unfortunate case the requested string cannot be obtained. We have to figure out why this happens at all, because Chrome doesn't look affected

[simonhong]

Maybe our native view elements don't provide proper AXNodeData data?

[iefremov]

Maybe our native view elements don't provide proper AXNodeData data?

Apparently yes! I've spent some time trying to figure that out, but found only 2-3 unrelated issues. Will need to investigate it further

[kjozwiak]

Attempted to reproduce the crash with 1.21.35 CR: 88.0.4324.96 but couldn't reproduce. After speaking with @iefremov, this could be a Catalina vs Big Sur issue. Going to work with @LaurenWags to see if she can reproduce as she's on Catalina as well.

If QA can't reproduce @iefremov, we might just need to uplift and have @iefremov verify it once we uplift and get a 1.19.x build.

[LaurenWags]

Encountered a crash on 1.21.30

Brave | 1.21.30 Chromium: 88.0.4324.96 (Official Build) nightly (x86_64)
-- | --
Revision | 68dba2d8a0b149a1d3afac56fa74648032bcf46b-refs/branch-heads/4324@{#1784}
OS | macOS Version 10.15.7 (Build 19H15)

Enabled Typing Feedback in Accessibility settings (also enabled all 4 options for this):

STR:

1. Clean profile
2. Login to mail.google.com
3. Quickly open a new tab using cmd + t and type m immediately followed by pressing return.
4. Repeat step 3 quickly several times
5. Brave crashed.

Crash Report ID: 421a0000-9cc8-c705-0000-000000000000

[LaurenWags]

Verified passed with

Brave | 1.19.90 Chromium: 88.0.4324.146 (Official Build) (x86_64)
-- | --
Revision | 406dc88511162d6598242f2c709be1414a042fb0-refs/branch-heads/4324@{#2088}
OS | macOS Version 10.15.7 (Build 19H15)

Verified steps from #13778 (comment) multiple times. No crash observed but still have open issue #13837 as the crash does still occur sometimes.

---

Verification PASSED on macOS 11.1 x64 using the following build:

Brave | 1.19.90 Chromium: 88.0.4324.146 (Official Build) (x86_64)
--- | ---
Revision | 406dc88511162d6598242f2c709be1414a042fb0-refs/branch-heads/4324@{#2088}
OS | macOS Version 11.1 (Build 20C69)

Ran through #13778 (comment) for ~20-30min and managed Brave to crash the browser twice via the follownig:

• Uploaded Crash Report ID: d6010000-5c00-d105-0000-000000000000
• Uploaded Crash Report ID: d5010000-5c00-d105-0000-000000000000

However, I'm not sure if these are related to accessibility but it's definitely a lot better as @LaurenWags mentioned above. We have #13837 filed as a follow up to address the other crashes as @LaurenWags mentioned.