This one beats JAWS users (http://www.freedomscientific.com/Products/Blindness/JAWS), it crashes whenever Nightly is running (the issue has been reported by FS contact). The stack is: ntdll.dll!_KiFastSystemCallRet@0 () Unknown ntdll.dll!_ZwWaitForSingleObject@12 () Unknown ntdll.dll!_RtlReportExceptionEx@16 () Unknown ntdll.dll!_RtlReportException@12 () Unknown ole32.dll!SilentlyReportExceptions(_EXCEPTION_POINTERS * lpep) Line 133 C++ ole32.dll!ServerExceptionFilter(_EXCEPTION_POINTERS * lpep) Line 190 C++ ole32.dll!AppInvokeExceptionFilterWithMethodAddress(_EXCEPTION_POINTERS * lpep, void * pvObject, const _GUID & riid, unsigned long dwMethod, void * pvVtableAddress, const char * szPossibleCause) Line 379 C++ ole32.dll!SyncStubInvoke(tagRPCOLEMESSAGE * pMsg, const _GUID & riid, CIDObject * pID, void * pVtableAddress, IRpcChannelBuffer * pChnl, IRpcStubBuffer * pStub, unsigned long * pdwFault) Line 1193 C++ msvcrt.dll!@_EH4_CallFilterFunc@8 () Unknown ntdll.dll!ExecuteHandler2@20 () Unknown ntdll.dll!ExecuteHandler@20 () Unknown ntdll.dll!_RtlDispatchException@8 () Unknown ntdll.dll!_KiUserExceptionDispatcher@8 () Unknown > xul.dll!nsGlobalWindow::GetComputedStyleHelper(mozilla::dom::Element & aElt, const nsAString_internal & aPseudoElt, bool aDefaultStylesOnly, mozilla::ErrorResult & aError) Line 9997 C++ xul.dll!nsGlobalWindow::GetComputedStyle(mozilla::dom::Element & aElt, const nsAString_internal & aPseudoElt, mozilla::ErrorResult & aError) Line 9910 C++ xul.dll!mozilla::a11y::nsWinUtils::GetComputedStyleDeclaration(nsIContent * aContent) Line 56 C++ xul.dll!mozilla::a11y::sdnAccessible::get_computedStyleForProperties(unsigned short aNumStyleProperties, unsigned char aUseAlternateView, wchar_t * * aStyleProperties, wchar_t * * aStyleValues) Line 282 C++ FsDomNodeFirefox.dll!51682b54() Unknown It crashes in: nsGlobalWindow::GetComputedStyleHelper(Element& aElt, const nsAString& aPseudoElt, bool aDefaultStylesOnly, ErrorResult& aError) On the line: FORWARD_TO_OUTER_OR_THROW(GetComputedStyleHelperOuter, (aElt, aPseudoElt, aDefaultStylesOnly), aError, nullptr); Locals: + this msvcr120.dll!0x0028e040 {mRefCnt={mRefCntAndFlags=0 } mIdleObservers={...} mIdleTimer={...} ...} nsGlobalWindow * + aElt {...} mozilla::dom::Element & + aPseudoElt {mData=0x032033e0 L"" mLength=0 mFlags=1 } const nsAString_internal & aDefaultStylesOnly false bool - aError {mResult=NS_OK (0) mMessage=0x00000128 {mArgs={...} mErrorNumber=??? } mJSException={data={asBits=35747648459768104 ...} } ...} mozilla::ErrorResult & mResult NS_OK (0) nsresult + mMessage 0x00000128 {mArgs={...} mErrorNumber=??? } mozilla::ErrorResult::Message * + mJSException {data={asBits=35747648459768104 s={payload={i32=296 u32=296 boo=296 ...} tag=8323148 } asDouble=2.7591947984242959e-306 ...} } JS::Value + mDOMExceptionInfo 0x00000128 {mMessage={...} mRv=??? } mozilla::ErrorResult::DOMExceptionInfo *

[Tracking Requested - why for this release]: So nsGlobalWindow::GetComputedStyle should be called on an inner window. nsWinUtils::GetComputedStyleDeclaration is calling it on the return value of nsIDocument::GetWindow, which is the outer window. Kyle, did we just both miss this?

Yeah, that's just busted. I'll fix it.

Is there any change to back port it to Aurora please?

Comment on attachment 8684572 [details] [diff] [review] 0001-Bug-1222127-Use-the-inner-window-to-compute-style.-r.patch Approval Request Comment [Feature/regressing bug #]: Bug 1222127 [User impact if declined]: a11y tools crash [Describe test coverage new/current, TreeHerder]: manual testing [Risks and why]: extremely low risk, patch is trivial [String/UUID change made/needed]: N/A

(In reply to Kyle Huey [:khuey] (khuey@mozilla.com) from comment #7) > Comment on attachment 8684572 [details] [diff] [review] > 0001-Bug-1222127-Use-the-inner-window-to-compute-style.-r.patch > > Approval Request Comment > [Feature/regressing bug #]: Bug 1222127 Er, bug 1216401.

Comment on attachment 8684572 [details] [diff] [review] 0001-Bug-1222127-Use-the-inner-window-to-compute-style.-r.patch Crash fix, taking it for Aurora44.

Tracked since this is a crash.

Alexandar, could you please verify that this issue is fixed as expected on a latest Nightly build? Thanks!

(In reply to Ritu Kothari (:ritu) from comment #11) > Alexandar, could you please verify that this issue is fixed as expected on a > latest Nightly build? Thanks! I was reported that it's indeed fixed.