Differential Revision: https://phabricator.services.mozilla.com/D173916

Differential Revision: https://phabricator.services.mozilla.com/D173651

Differential Revision: https://phabricator.services.mozilla.com/D173918

Bug 1821448: Improve handling of reentry in MsaaAccessible::VisitDocAccessibleParentDescendantsAtTopLevelInContentProcess. r=nlapre, a=RyanVM

Differential Revision: https://phabricator.services.mozilla.com/D173652

Differential Revision: https://phabricator.services.mozilla.com/D170310

Differential Revision: https://phabricator.services.mozilla.com/D170086

Bug 1798098: Prevent a11y tree walks by the Suggested Actions feature in Windows 11 22H2. r=nlapre, a=RyanVM

The patches in bug 1774285 prevent Suggested Actions a11y tree walking in most cases.
However, when a11y is already enabled, we can still get into a tree walk that triggers a hang when using Copy Phone Number on a tel: link.
This is because there is no selected text in this case, so Suggested Actions falls back to walking the tree.

This patch prevents these walks by returning 1 from get_nSelections within a timeout period after setting the clipboard, indicating that there is a selection when there isn't really.
Unfortunately, even though we lie about the selection count, the selection reported by get_selection still isn't valid.
Fixing that for a selection deep in the tree is difficult; we don't have enough information in the parent process to fake the selection properly.
Thus, Suggested Actions might then do a normal tree walk from the document, so we also return a 0 child count within this timeout period.
With the cache disabled, in-process Windows clients access content process Accessibles using COM proxies.
We must therefore hack get_nSelections and get_accChildCount in AccessibleHandler, which wraps these COM proxies for in-process clients.
This means that Firefox needs to be installed in order for this to work, since AccessibleHandler can only be used with an installed copy.
A11y performance without the cache is very poor without AccessibleHandler anyway.
Because AccessibleHandler is an entirely separate dll, we need to duplicate the suppression logic in AccessibleHandlerControl, which can be accessed by both Gecko and AccessibleHandler.

After all these attempts on the document, Suggested Actions falls back to walking from the root.
To prevent that walk, we return 0 for the child count on the root MsaaAccessible within the timeout period.

Differential Revision: https://phabricator.services.mozilla.com/D160746

This prevents a11y from getting instantiated shortly after clipboard paste, in
order to prevent hangs with the Windows 11 suggested actions feature.

When combined with the previous patch, the behavior is the following:

 * For users with a11y already-enabled:

   * No hang (due to clipboard flush).
   * Quick actions menu is positioned at selection offset.

 * For users with a11y disabled (most):

   * No hang (due to no a11y instantiation + clipboard flush).
   * Quick actions menu is positioned at pointer (cursor) offset.

Co-Authored-By: Emilio Cobos Álvarez <emilio@crisal.io>

Differential Revision: https://phabricator.services.mozilla.com/D160652

Depends on D160646

Differential Revision: https://phabricator.services.mozilla.com/D156605

Bug 1771271 - Check for mCachedFields for all remote accessibles in BoundsWithOffset. r=morgan a=pascalc

Differential Revision: https://phabricator.services.mozilla.com/D147791

Differential Revision: https://phabricator.services.mozilla.com/D147854

Remove assert for doc to be last accessible to be removed because
in a doc shutdown scenario it will be the first to be removed.

Differential Revision: https://phabricator.services.mozilla.com/D148045

None of the consumer need to mutate styles, and this saves some ugly
const_casting on the next patch.

Doesn't change behavior.

Differential Revision: https://phabricator.services.mozilla.com/D147555

Differential Revision: https://phabricator.services.mozilla.com/D147245

Bug 1737919 part 4: Update cached spelling errors when a spelling error is added without the text changing. r=morgan,smaug

We already have an nsISelectionListener, but that only tells us that a change happened somewhere in the selection, not which range changed.
We don't want to push a cache update for all ranges when only one changed.
Therefore, this patch adds an accessibility notification in mozInlineSpellChecker::AddRange.
We don't need this for removed ranges because the text will change for any spelling error corrections and text updates trigger spelling error cache updates.

Differential Revision: https://phabricator.services.mozilla.com/D147244

Even though spelling errors can cross Accessibles and are represented in the DOM as ranges, we cache them for each text leaf.
This is necessary so that we correctly update the offsets when text is inserted or removed from a leaf.
We cache them as an array of offsets, including both the start and end offset for each range.
We use -1 as the start offset to indicate when a spelling error starts in a previous Accessible.
When a spelling error starts in an Accessible but ends in a subsequent one, we simply don't include an end offset in the array.
This structure means we can easily query spelling error points or ranges with a binary search.

Differential Revision: https://phabricator.services.mozilla.com/D147243

The implementation searches for spelling errors in each leaf, as this is how we will need to do it for RemoteAccessibles.

Differential Revision: https://phabricator.services.mozilla.com/D147242

Bug 1737919 part 1: TextLeafPoint::FindTextAttrsStart: Don't allow the caller to supply origin attributes. r=morgan

This was done for LocalAccessibles to avoid the need to fetch attributes twice when we're simultaneously fetching boundaries and returning the attributes to a client.
However, GetTextAttributes will soon handle spelling errors, so it will no longer return the same data as GetTextAttributesLocalAcc (which doesn't handle spelling errors).
This breaks the equality checks in FindTextAttrsStart.
Aside from this, this argument was somewhat confusing.

For now, just remove aOriginAttrs, which means there will be some redundant calls to GetTextAttributesLocalAcc.
Parent process documents shouldn't be that large anyway.
If this ends up being a real problem, we can either revert to the local HyperTextAccessible implementation of text attributes or implement a smarter temporary cache.

Differential Revision: https://phabricator.services.mozilla.com/D147241

Bug 1771259: Fix crash when calling TextLeafPoint::CharBounds on the insertion point at the end of a text box. r=morgan

Differential Revision: https://phabricator.services.mozilla.com/D147397

We detect this in the same way that we detect whether we need to push line starts; i.e. a text update or a bounds change.
Since this is tied to the Text and Bounds domains, I removed the separate TextBounds domain.

Differential Revision: https://phabricator.services.mozilla.com/D147396

Bug 1771060: Make use of the line cursor in IsLocalAccAtLineStart to improve performance. r=jfkthame

For block frames, nsLineIterator doesn't use the line cursor, so switch to nsBlockInFlowLineIterator.
We don't actually care about the line number here anyway.

Differential Revision: https://phabricator.services.mozilla.com/D147237

There can be LocalAccessibles which don't die until the final cycle collection during XPCOM shutdown.
MsaaIdGenerator::ReleaseID (called during deletion of a LocalAccessible) uses a timer when the cache is enabled, but timers can't be used after XPCOM shutdown.
This was causing an assertion.
In addition, because MsaaIdGenerator is a static instance, the timer could be deleted after XPCOM shutdown, causing a warning.
To fix this:

1. If accessibility is shut down, just release ids immediately.
2. Clean up any remaining ids and the timer on XPCOM shutdown.

A better solution would be to create and terminate MsaaIdGenerator during a11y startup and shutdown, but this is a bit tricky while we still have the non-cache code paths.
Once we don't need the non-cache code, MsaaIdGenerator will become a lot simpler, so this refactor will be easier then.

Differential Revision: https://phabricator.services.mozilla.com/D146866

Differential Revision: https://phabricator.services.mozilla.com/D145908

Bug 1745024 - avoid keeping an 'Accessibility notifications' refresh observer for initial about:blank documents, r=Jamie.

Differential Revision: https://phabricator.services.mozilla.com/D143747

This change allows us to remove the `FullZoom` multiplier and fixes text
bounds caclulations in a zoomed page.

Testing: The current browser scroll/bounds tests pass (with the
exception of fission iframes which were already broken).

Differential Revision: https://phabricator.services.mozilla.com/D146507

Differential Revision: https://phabricator.services.mozilla.com/D146452

Bug 1514936, part 1 - Remove the outer argument to nsIFactory::createInstance. r=xpcom-reviewers,preferences-reviewers,nika,Gijs

This patch won't actually build, because a few bits of code are used
for both nsIFactory::createInstance and static components, and static
components are not fixed until the next patch.

The first place is nsLoadGroupConstructor, which uses an nsIFactory
macro to create a static component constructor. (This could be worked
around by expanding the macro to the state before this patch.)

The other issue is that nsAppShellConstructor is used in an nsIFactory
on OSX, but as a static component on all other platforms. This could
be worked around by wrapping nsAppShellConstructor in an adaptor that
passes in the extra null argument to nsAppShellConstructor.

Differential Revision: https://phabricator.services.mozilla.com/D146456

Backed out 5 changesets (bug 1769569) for causing devtools' browser/browser_page_redirection.js to fail. CLOSED TREE

Backed out changeset 66a42eb3a366 (bug 1769569)
Backed out changeset d3cc9629cd9a (bug 1769569)
Backed out changeset edcd3dade079 (bug 1769569)
Backed out changeset 29d8dd058b7a (bug 1769569)
Backed out changeset 1aed34fdf2d3 (bug 1769569)

Differential Revision: https://phabricator.services.mozilla.com/D146452

Bug 1768219: Don't walk ancestors on all Accessibles to find an action when serialising the IPC tree. r=eeejay

This was causing a performance regression.
We now only do this for text leaf and image Accessibles, which gets us back to where we were before bug 1395181.
This means we can't support "click ancestor" on ATK.
There weren't requests for this on ATK anyway.
In future, we can probably support this using the information in the cache.

Differential Revision: https://phabricator.services.mozilla.com/D146528

This interface should no longer be required due to the changes in part 1
limiting the complexity of IPCStream instances and limiting the number of file
descriptors which a single stream can attach to a message.

Removing this interface is necessary to serialize nsIInputStream instances over
arbitrary toplevel protocols and non-protocol IPC in the future.

Differential Revision: https://phabricator.services.mozilla.com/D141039

We can't use the StringBundle object off the main thread. We need to
pre-load all the strings we may use. This is a small set of roles. We
also need formatted heading levels, so we preload heading level 1 to 6.

Differential Revision: https://phabricator.services.mozilla.com/D146112

We rely on Recv events to be called from child processes and not from
other Recv events. If this happens we risk reentry in regards to the
android monitor lock. So this patch introduces FireEvent for internal
use where secondary events need to be fired like a reorder when a new
sub-document is added.

Differential Revision: https://phabricator.services.mozilla.com/D146134

Testing note - this enables junit tests to start and pass more reliably
when caching is enabled.

Differential Revision: https://phabricator.services.mozilla.com/D146106

Depends on D143527

Differential Revision: https://phabricator.services.mozilla.com/D144893

Backed out 22 changesets (bug 1696894, bug 1759569, bug 1754031, bug 1759563, bug 1759572, bug 1754004) for causing leack failures CLOSED TREE

Backed out changeset 673ecd5337e1 (bug 1754004)
Backed out changeset ecbf5f3c51de (bug 1754004)
Backed out changeset fc6c39f56d21 (bug 1754004)
Backed out changeset 5b3d58fbaf9d (bug 1696894)
Backed out changeset 2e56c89cf55d (bug 1754004)
Backed out changeset b7723490f025 (bug 1754004)
Backed out changeset 1dfbf61ff5dd (bug 1754004)
Backed out changeset e73abb071bb3 (bug 1754004)
Backed out changeset f9abe4fbf501 (bug 1754004)
Backed out changeset ee7aeb631cd9 (bug 1754004)
Backed out changeset d66aacfcf983 (bug 1754004)
Backed out changeset 5c2872ad6912 (bug 1754004)
Backed out changeset e1ae48f30d2c (bug 1754004)
Backed out changeset 849b63707d7f (bug 1754004)
Backed out changeset 36563e3b1e04 (bug 1754004)
Backed out changeset ccb4be659107 (bug 1754004)
Backed out changeset 659581d4159b (bug 1754004)
Backed out changeset 611ea76d7a9c (bug 1754004)
Backed out changeset 9b24b561698c (bug 1759572)
Backed out changeset f820e0f209ff (bug 1759563)
Backed out changeset 8d82066fa181 (bug 1759569)
Backed out changeset a2835afab1ad (bug 1754031)

In Android we need to keep the remote accessible methods thread safe. That means no direct references to local accessibles, or anything DOM or layout.

We have the advantage of always being remote except for a 0 offset browser element, and no support for full page zoom.

Also removed the visual/layout viewport offset in the bounds method since
the top level doc will always have its visual and layout viewport match.

Differential Revision: https://phabricator.services.mozilla.com/D146006

Previously, we invalidated this cache when the reorder event arrived.
Because the mutation and the reorder event happen in separate IPDL calls, it's possible for a client call to arrive between them.
If that client call queried HyperText offsets, this could result in returning incorrect information to the client or even a parent process crash.
Now, we invalidate the cache during the mutation, so there's no possibility of an intervening client call.
It made sense to put this invalidation call in RemoteAccessibleBase, so I also moved the call to invalidate for text leaf updates into RemoteAccessibleBase so that they're both in the same class.

Differential Revision: https://phabricator.services.mozilla.com/D145845

This interface should no longer be required due to the changes in part 1
limiting the complexity of IPCStream instances and limiting the number of file
descriptors which a single stream can attach to a message.

Removing this interface is necessary to serialize nsIInputStream instances over
arbitrary toplevel protocols and non-protocol IPC in the future.

Differential Revision: https://phabricator.services.mozilla.com/D141039

Differential Revision: https://phabricator.services.mozilla.com/D145847