Joanmarie Diggs Reporter
	Description • 9 years ago

NOTE: The steps to reproduce are precise for a reason. Explanation will follow.

Steps to reproduce:
1. Launch the attached accessible-event listener in a terminal
2. Load http://archive.dojotoolkit.org/nightly/dojotoolkit/dijit/tests/form/test_Button.html
3. Tab 6 times (to give focus to the down triangle on "+ Create" button
4. Press Space to expand the drop down
5. Press Escape to close the drop down and refocus the down triangle button
6. If you want to repeat this, quit and restart Firefox

Results without e10s:
Source: [push button | save options], Source parent: [paragraph | ], Source's index in parent: 7
Source: [push button | save options], Source parent: [paragraph | ], Source's index in parent: 1
Source: [push button | save options], Source parent: [paragraph | ], Source's index in parent: 1

Results with e10s:
Source: [push button | save options], Source parent: [paragraph | ], Source's index in parent: 7
Source: [push button | save options], Source parent: [paragraph | ], Source's index in parent: -1
Source: [push button | save options], Source parent: [paragraph | ], Source's index in parent: -1

Results both with and without e10s if you didn't use Tab, but used the mouse to focus and expand that same widget:
Source: [push button | save options], Source parent: [table | ], Source's index in parent: 1
Source: [push button | save options], Source parent: [table | ], Source's index in parent: 1

But wait... There's more: Because the index in parent of -1 suggests a broken tree and/or that the object is in the process of being destroyed, I experimented with clearing the AT-SPI2 cache, and re-exploring the accessibility tree from the top down. By doing so, I found the accessible table which became the new parent of the button (and which is the reported parent if you use the mouse). If you then ask the table for the child at index 1, you get the button. So far so good. However, if you ask that newly-retrieved accessible button for its parent, it returns the paragraph; not the table. This makes things rather challenging to work around. :(

Any chance this is a side effect of the changes related to aria-owns?

	Marco Zehe (:MarcoZ)
	Comment 1 • 9 years ago

Ouch, this sounds bad! Alex, any ideas?

	alexander :surkov (:asurkov)
	Comment 2 • 9 years ago

I plan to change aria-owns implementation, let's see if it helps

	alexander :surkov (:asurkov)
	Comment 3 • 9 years ago

Joanie, can you give it a try, since bug 1219299 was fixed? Tree looks good on DOMi side.

	Joanmarie Diggs Reporter
	Comment 4 • 9 years ago

I get the very same results as stated in the opening report. I'm using 45.0a1 (2015-11-10).

	Joanmarie Diggs Reporter
	Comment 5 • 8 years ago

Trying this with the latest nightly, I cannot reproduce the issue as described in the opening report: With both e10s and without e10s, the 2nd and 3rd events described in the opening report are absent.

HOWEVER, the accessibility tree with and without e10s is different: With e10s enabled, the push button does not appear in the accessibility tree; some childless table does. As a result of this brokenness, Orca does not present the dojo push button mentioned in the opening report *at all*.

	alexander :surkov (:asurkov)
	Comment 6 • 8 years ago

bug 1294853 might help to e10s as it's supposed to fix show/hide events ordering for aria-owns stuff

	Daniel Veditz [:dveditz]
	Comment 7 • 8 years ago

How is this a security risk for our users? Can we unhide the bug? There's a guess about possibly deleted objects which could be tested in Valgrind or in an ASAN build.

	alexander :surkov (:asurkov)
	Comment 8 • 8 years ago

I'm not sure why this bug was marked as security issue. So until Joanie has more data, I would say the bug can be unhidden.

	Alex ARNAUD
	Comment 9 • 7 years ago

(In reply to Joanmarie Diggs from comment #0)
> Results without e10s:
> Source: [push button | save options], Source parent: [paragraph | ],
> Source's index in parent: 7
> Source: [push button | save options], Source parent: [paragraph | ],
> Source's index in parent: 1
> Source: [push button | save options], Source parent: [paragraph | ],
> Source's index in parent: 1
> 
> Results with e10s:
> Source: [push button | save options], Source parent: [paragraph | ],
> Source's index in parent: 7
> Source: [push button | save options], Source parent: [paragraph | ],
> Source's index in parent: -1
> Source: [push button | save options], Source parent: [paragraph | ],
> Source's index in parent: -1
> 
> Results both with and without e10s if you didn't use Tab, but used the mouse
> to focus and expand that same widget:
> Source: [push button | save options], Source parent: [table | ], Source's
> index in parent: 1
> Source: [push button | save options], Source parent: [table | ], Source's
> index in parent: 1
> 
> But wait... There's more: Because the index in parent of -1 suggests a
> broken tree and/or that the object is in the process of being destroyed, I
> experimented with clearing the AT-SPI2 cache, and re-exploring the
> accessibility tree from the top down. By doing so, I found the accessible
> table which became the new parent of the button (and which is the reported
> parent if you use the mouse). If you then ask the table for the child at
> index 1, you get the button. So far so good. However, if you ask that
> newly-retrieved accessible button for its parent, it returns the paragraph;
> not the table. This makes things rather challenging to work around. :(

@Joanie: If I understand well, you've implemented a work-around into Orca to figure out this issue ? What do you mean by when you try to get its parent (by user perspective) ? Do you mean pressing down arrow ?

Best regards.

	Joanmarie Diggs Reporter
	Comment 10 • 7 years ago

Users don't get parents of objects; Orca gets parents of objects and uses parent information when deciding what and how to present.

	Alex ARNAUD
	Comment 11 • 7 years ago

(In reply to Joanmarie Diggs from comment #10)
> Users don't get parents of objects; Orca gets parents of objects and uses
> parent information when deciding what and how to present.

Hello Joanie,

Thanks for your answer, I don't understand the usacase here. Could you give me an example o

	Alex ARNAUD
	Comment 12 • 7 years ago

...Could you give me an example of a user action where the parent is used ?

Best regards.

ps:sorry for the double post, the focus mode makes me crazy on nightly.

	Sylvestre Ledru [:Sylvestre]
	Comment 13 • 6 years ago

Moving to p3 because no activity for at least 1 year(s).
See https://github.com/mozilla/bug-handling/blob/master/policy/triage-bugzilla.md#how-do-you-triage for more information