7 crashes from 2+ machines with Firefox 102.0a1 and 103.0a1. Setting as regression from bug 1737919, please adjust if necessary.

Crash report: https://crash-stats.mozilla.org/report/index/cc1823c2-7cf2-463a-bed9-20cc20220606

Reason: EXCEPTION_ACCESS_VIOLATION_READ

Top 10 frames of crashing thread:

0 xul.dll mozilla::a11y::RenderedToContentOffset accessible/base/TextLeafRange.cpp:59
1 xul.dll mozilla::a11y::FindDOMSpellingErrors accessible/base/TextLeafRange.cpp:420
2 xul.dll mozilla::a11y::TextLeafPoint::FindSpellingErrorSameAcc const accessible/base/TextLeafRange.cpp:1115
3 xul.dll mozilla::a11y::TextLeafPoint::FindTextAttrsStart const accessible/base/TextLeafRange.cpp:1345
4 xul.dll mozilla::a11y::HyperTextAccessibleBase::TextAttributes accessible/basetypes/HyperTextAccessibleBase.cpp:619
5 xul.dll mozilla::a11y::HyperTextAccessible::TextAttributes accessible/generic/HyperTextAccessible.cpp:1189
6 xul.dll mozilla::a11y::ia2AccessibleText::get_attributes accessible/windows/ia2/ia2AccessibleText.cpp:73
7 nvdahelperremote.dll GeckoVBufBackend_t::fillVBuf C:\projects\nvda\build\x86_64\vbufBackends\gecko_ia2\gecko_ia2.cpp:915
8 nvdahelperremote.dll GeckoVBufBackend_t::render C:\projects\nvda\build\x86_64\vbufBackends\gecko_ia2\gecko_ia2.cpp:1275
9 nvdahelperremote.dll VBufBackend_t::update C:\projects\nvda\build\x86_64\vbufBase\backend.cpp:206

I'm assuming this is happening because the TextLeafAccessible doesn't have an nsTextFrame frame. This can happen when dealing with a XULLabelTextLeafAccessible which has an nsTextBoxFrame instead. This also makes sense since this crash is happening in the parent process where a XUL label text is most likely to be encountered.

https://hg.mozilla.org/mozilla-central/rev/027e84c2375c

The patch landed in nightly and beta is affected.
:eeejay, is this bug important enough to require an uplift?

• If yes, please nominate the patch for beta approval.
• If no, please set status-firefox102 to wontfix.

For more information, please visit auto_nag documentation.