.cargo/config.in

@@ -70,7 +70,7 @@ rev = "746743227485a83123784df0c53227ab466612ed"
 [source."https://github.com/hsivonen/packed_simd"]
 git = "https://github.com/hsivonen/packed_simd"
 replace-with = "vendored-sources"
-rev = "c149d0a519bf878567c7630096737669ec2ff15f"
+rev = "f38664024b29d44c506431eada7c112629bb1aa9"
 
 [source."https://github.com/hsivonen/chardetng_c"]
 git = "https://github.com/hsivonen/chardetng_c"

.cron.yml

@@ -149,19 +149,6 @@ jobs:
       when:
           - {hour: 2, minute: 0}
 
-    - name: updatebot-cron-job
-      job:
-          type: decision-task
-          treeherder-symbol: updatebot
-          target-tasks-method: updatebot_cron
-      run-on-projects:
-          - mozilla-central
-      when:
-          - {hour: 0, minute: 0}
-          - {hour: 6, minute: 0}
-          - {hour: 12, minute: 0}
-          - {hour: 18, minute: 0}
-
     - name: customv8-update
       job:
           type: decision-task
@@ -196,6 +183,7 @@ jobs:
           - mozilla-beta
           - mozilla-release
           - mozilla-esr91
+          - mozilla-esr102
       when:
           by-project:
               # No default branch
@@ -211,6 +199,9 @@ jobs:
               mozilla-esr91:
                   - {hour: 7, minute: 0}
                   - {hour: 19, minute: 0}
+              mozilla-esr102:
+                  - {hour: 7, minute: 0}
+                  - {hour: 19, minute: 0}
 
     - name: periodic-update
       job:

.eslintignore

@@ -147,6 +147,9 @@ js/src/Y.js
 # Fuzzing code for testing only, targeting the JS shell
 js/src/fuzz-tests/
 
+# uses `#include`
+mobile/android/app/000-tor-browser-android.js
+
 # Uses `#filter substitution`
 mobile/android/app/mobile.js
 mobile/android/app/geckoview-prefs.js

.gitlab/issue_templates/UXBug.md

+<!--
+* Use this issue template for reporting a new UX bug.
+-->
+
+### Summary
+**Summarize the bug encountered concisely.**
+
+
+### Steps to reproduce:
+**How one can reproduce the issue - this is very important.**
+
+1. Step 1
+2. Step 2
+3. ...
+
+### What is the current bug behavior?
+**What actually happens.**
+
+
+### What is the expected behavior?
+**What you want to see instead**
+
+
+
+## Relevant logs and/or screenshots
+**Do you have screenshots? Attach them to this ticket please.**
+
+/label ~tor-ux ~needs-investigation ~bug
+/assign @nah

.gitlab/issue_templates/bug.md

+<!--
+* Use this issue template for reporting a new bug.
+-->
+
+### Summary
+**Summarize the bug encountered concisely.**
+
+
+### Steps to reproduce:
+**How one can reproduce the issue - this is very important.**
+
+1. Step 1
+2. Step 2
+3. ...
+
+### What is the current bug behavior?
+**What actually happens.**
+
+
+### What is the expected behavior?
+**What you want to see instead**
+
+
+
+### Environment
+**Which operating system are you using? For example: Debian GNU/Linux 10.1, Windows 10, Ubuntu Xenial, FreeBSD 12.2, etc.**
+**Which installation method did you use? Distribution package (apt, pkg, homebrew), from source tarball, from Git, etc.**
+
+### Relevant logs and/or screenshots
+
+
+/label ~bug

.gitlab/merge_request_templates/default.md

+## Merge Info
+
+<!-- Bookkeeping information for release management -->
+
+- ### Related Issues
+  - tor-browser#xxxxx
+  - tor-browser-build#xxxxx
+  - etc
+
+- ### Backport Timeline
+  - [ ] **Immediate** - patchsets for critical bug fixes or other major blocker (e.g. fixes for a 0-day exploit) OR patchsets with trivial changes which do not need testing (e.g. fixes for typos or fixes easily verified in a local developer build)
+  - [ ] **Next Minor Stable Release** - patchset that needs to be verified in nightly before backport
+  - [ ] **Eventually** - patchset that needs to be verified in alpha before backport
+  - [ ] **No Backport** - patchset for the next major stable
+
+- ### Upstream Merging
+  - [ ] Merge to `base-browser` - typically for `!fixups` to patches in the `base-browser` branch, though sometimes new patches as well
+    - **NOTE**: if your changeset includes patches to both `base-browser` and `tor-browser` please please make separate merge requests for each part
+
+- ### Issue Tracking
+  - [ ] Link resolved issues with appropriate [Release Prep issue](https://gitlab.torproject.org/groups/tpo/applications/-/issues/?sort=updated_desc&state=opened&label_name%5B%5D=Release%20Prep&first_page_size=20) for changelog generation
+
+## Change Description
+
+<!-- Whatever context the reviewer needs to effectively review the patchset -->
\ No newline at end of file

.hgtags

@@ -3703,3 +3703,35 @@ ac17d3e21f82ce34b2b9f09f8a15b270cf41e91c FIREFOX_RELEASE_102_BASE
 085af07e5cc10082e793203e049ee4d6127a452f FIREFOX_RELEASE_102_BASE
 910517036c968689e4268026543119fcf6628049 FIREFOX_RELEASE_102_BASE
 555c7ef72f772d24616bbb6c1cec6cd756b51685 FIREFOX_RELEASE_101_END
+3ea5c8008221e11b3c674f09968535cd4f6d6efe FIREFOX_ESR_102_BASE
+1ae616302bf7261f95f4f2a5d56e1d7a38ff5d60 FIREFOX_102_0esr_BUILD1
+4180ec744bb748a5fd39e25d122c4b500c3a2a00 FIREFOX_102_0esr_BUILD2
+4180ec744bb748a5fd39e25d122c4b500c3a2a00 FIREFOX_102_0esr_RELEASE
+776aca9b706c13a2597f22b739ecd0c3ab6f1d2e FIREFOX_102_0_1esr_BUILD1
+776aca9b706c13a2597f22b739ecd0c3ab6f1d2e FIREFOX_102_0_1esr_RELEASE
+73db4126165f2a2eded92f48a6c81c8ece6d21ce FIREFOX_102_1_0esr_BUILD1
+73db4126165f2a2eded92f48a6c81c8ece6d21ce FIREFOX_102_1_0esr_RELEASE
+40d1412657291933cc2c9d65c3306927c1b332e1 FIREFOX_102_2_0esr_BUILD1
+3876d5327f44c991c9034c4112f33f147ab10ab9 FIREFOX_102_2_0esr_BUILD2
+3876d5327f44c991c9034c4112f33f147ab10ab9 FIREFOX_102_2_0esr_RELEASE
+c2dd0f1c0adfb1fa1c5d9319fbe023d324c34db6 FIREFOX_102_3_0esr_BUILD1
+c2dd0f1c0adfb1fa1c5d9319fbe023d324c34db6 FIREFOX_102_3_0esr_RELEASE
+52928ba6fd91414091326fe6339bc63e89b593a6 FIREFOX_102_4_0esr_BUILD1
+52928ba6fd91414091326fe6339bc63e89b593a6 FIREFOX_102_4_0esr_RELEASE
+28738f45597b736e5689c199131d5da9ae0a6cec FIREFOX_102_5_0esr_BUILD1
+28738f45597b736e5689c199131d5da9ae0a6cec FIREFOX_102_5_0esr_RELEASE
+72b501d7159eb634a961e27157a3af58360a0b74 FIREFOX_102_6_0esr_BUILD1
+72b501d7159eb634a961e27157a3af58360a0b74 FIREFOX_102_6_0esr_RELEASE
+cff83fd04112a3b0d4091a1982d7219d200f6fa6 FIREFOX_102_7_0esr_BUILD1
+cff83fd04112a3b0d4091a1982d7219d200f6fa6 FIREFOX_102_7_0esr_RELEASE
+291d5baee192abe6f859a6528a9444d6aa24bb8a FIREFOX_102_8_0esr_BUILD1
+6c317d15a0b7dffbbcdbeeeb8ec52b44610124af FIREFOX_102_8_0esr_BUILD2
+6c317d15a0b7dffbbcdbeeeb8ec52b44610124af FIREFOX_102_8_0esr_RELEASE
+a386fc0218e3d4d5147ff6716866198bab0fbaac FIREFOX_102_9_0esr_BUILD1
+e26ff04290d095dac006a3710b07077ee5d20f31 FIREFOX_102_9_0esr_BUILD2
+e26ff04290d095dac006a3710b07077ee5d20f31 FIREFOX_102_9_0esr_RELEASE
+737a5c36e0f939b688ff1d6fb75b139cfdf60ae9 FIREFOX_102_10_0esr_BUILD1
+737a5c36e0f939b688ff1d6fb75b139cfdf60ae9 FIREFOX_102_10_0esr_RELEASE
+350c74fdc5e2ddd6d706908cf7a2e67ea90db887 FIREFOX_102_11_0esr_BUILD1
+77dd215a134a9002bc9058de25328caf37baf636 FIREFOX_102_11_0esr_BUILD2
+77dd215a134a9002bc9058de25328caf37baf636 FIREFOX_102_11_0esr_RELEASE

.taskcluster.yml

@@ -101,7 +101,7 @@ tasks:
                                 description: 'Created by a [cron task](https://firefox-ci-tc.services.mozilla.com/tasks/${cron.task_id}) (${treeherder_link})'
 
               provisionerId: "${trustDomain}-${repository.level}"
-              workerType: "decision"
+              workerType: "decision-gcp"
 
               tags:
                   $if: 'tasks_for == "hg-push"'

CLOBBER

@@ -22,4 +22,4 @@
 # changes to stick? As of bug 928195, this shouldn't be necessary! Please
 # don't change CLOBBER for WebIDL changes any more.
 
-Merge day clobber 2022-06-20
\ No newline at end of file
+Merge day clobber 2023-05-08
\ No newline at end of file

Cargo.lock

@@ -394,8 +394,6 @@ dependencies = [
 [[package]]
 name = "bindgen"
 version = "0.56.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2da379dbebc0b76ef63ca68d8fc6e71c0f13e59432e0987e508c1820e6ab5239"
 dependencies = [
  "bitflags",
  "cexpr",
@@ -1539,8 +1537,6 @@ checksum = "7360491ce676a36bf9bb3c56c1aa791658183a54d2744120f27285738d90465a"
 [[package]]
 name = "fallible_collections"
 version = "0.4.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4ad9169582543d2cfe9961be1e9eaf4fc42f9aa3483f7c485717b8dde36466ea"
 dependencies = [
  "hashbrown",
 ]
@@ -3812,10 +3808,11 @@ dependencies = [
 
 [[package]]
 name = "packed_simd_2"
-version = "0.3.7"
-source = "git+https://github.com/hsivonen/packed_simd?rev=c149d0a519bf878567c7630096737669ec2ff15f#c149d0a519bf878567c7630096737669ec2ff15f"
+version = "0.3.8"
+source = "git+https://github.com/hsivonen/packed_simd?rev=f38664024b29d44c506431eada7c112629bb1aa9#f38664024b29d44c506431eada7c112629bb1aa9"
 dependencies = [
  "cfg-if 1.0.0",
+ "rustc_version",
 ]
 
 [[package]]

Cargo.toml

@@ -106,6 +106,9 @@ web-sys = { path = "build/rust/dummy-web/web-sys" }
 # Overrides to allow easier use of common internal crates.
 moz_asserts = { path = "mozglue/static/rust/moz_asserts" }
 
+# Patch bindgen to work around issues with some unsound transmutes when compiling with LLVM 16+.
+bindgen = { path = "third_party/rust/bindgen" }
+
 # Other overrides
 async-task = { git = "https://github.com/smol-rs/async-task", rev="f6488e35beccb26eb6e85847b02aa78a42cd3d0e" }
 chardetng = { git = "https://github.com/hsivonen/chardetng", rev="3484d3e3ebdc8931493aa5df4d7ee9360a90e76b" }
@@ -113,7 +116,7 @@ chardetng_c = { git = "https://github.com/hsivonen/chardetng_c", rev="ed8a4c6f90
 coremidi = { git = "https://github.com/chris-zen/coremidi.git", rev="fc68464b5445caf111e41f643a2e69ccce0b4f83" }
 fog = { path = "toolkit/components/glean/api" }
 libudev-sys = { path = "dom/webauthn/libudev-sys" }
-packed_simd = { package = "packed_simd_2", git = "https://github.com/hsivonen/packed_simd", rev="c149d0a519bf878567c7630096737669ec2ff15f" }
+packed_simd = { package = "packed_simd_2", git = "https://github.com/hsivonen/packed_simd", rev="f38664024b29d44c506431eada7c112629bb1aa9" }
 midir = { git = "https://github.com/mozilla/midir.git", rev = "4c11f0ffb5d6a10de4aff40a7b81218b33b94e6f" }
 minidump_writer_linux = { git = "https://github.com/rust-minidump/minidump-writer.git", rev = "75ada456c92a429704691a85e1cb42fef8cafc0d" }
 
@@ -121,3 +124,7 @@ minidump_writer_linux = { git = "https://github.com/rust-minidump/minidump-write
 # There is not going to be new version of mio 0.6, mio now being >= 0.7.11.
 [patch.crates-io.mio]
 path = "third_party/rust/mio-0.6.23"
+
+# Patch fallible_collections for issues with rustc 1.65.
+[patch.crates-io.fallible_collections]
+path = "third_party/rust/fallible_collections"

accessible/aom/AccessibleNode.h

@@ -101,7 +101,7 @@ class AccessibleNode : public nsISupports, public nsWrapperCache {
   explicit AccessibleNode(nsINode* aNode);
 
   NS_DECL_CYCLE_COLLECTING_ISUPPORTS;
-  NS_DECL_CYCLE_COLLECTION_SCRIPT_HOLDER_CLASS(AccessibleNode);
+  NS_DECL_CYCLE_COLLECTION_WRAPPERCACHE_CLASS(AccessibleNode);
 
   JSObject* WrapObject(JSContext* aCx, JS::Handle<JSObject*> aGivenProto) final;
   dom::ParentObject GetParentObject() const;

accessible/base/ARIAMap.cpp

@@ -1446,10 +1446,22 @@ uint8_t aria::GetIndexFromRoleMap(const nsRoleMapEntry* aRoleMapEntry) {
   } else if (aRoleMapEntry == &sLandmarkRoleMap) {
     return LANDMARK_ROLE_MAP_ENTRY_INDEX;
   } else {
-    return aRoleMapEntry - sWAIRoleMaps;
+    uint8_t index = aRoleMapEntry - sWAIRoleMaps;
+    MOZ_ASSERT(aria::IsRoleMapIndexValid(index));
+    return index;
   }
 }
 
+bool aria::IsRoleMapIndexValid(uint8_t aRoleMapIndex) {
+  switch (aRoleMapIndex) {
+    case NO_ROLE_MAP_ENTRY_INDEX:
+    case EMPTY_ROLE_MAP_ENTRY_INDEX:
+    case LANDMARK_ROLE_MAP_ENTRY_INDEX:
+      return true;
+  }
+  return aRoleMapIndex < ArrayLength(sWAIRoleMaps);
+}
+
 uint64_t aria::UniversalStatesFor(mozilla::dom::Element* aElement) {
   uint64_t state = 0;
   uint32_t index = 0;

accessible/base/ARIAMap.h

@@ -258,6 +258,11 @@ const nsRoleMapEntry* GetRoleMapFromIndex(uint8_t aRoleMapIndex);
  */
 uint8_t GetIndexFromRoleMap(const nsRoleMapEntry* aRoleMap);
 
+/**
+ * Determine whether a role map entry index is valid.
+ */
+bool IsRoleMapIndexValid(uint8_t aRoleMapIndex);
+
 /**
  * Return accessible state from ARIA universal states applied to the given
  * element.

accessible/ipc/DocAccessibleParent.cpp

@@ -4,6 +4,7 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
+#include "ARIAMap.h"
 #include "CachedTableAccessible.h"
 #include "DocAccessibleParent.h"
 #include "mozilla/a11y/Platform.h"
@@ -145,6 +146,10 @@ uint32_t DocAccessibleParent::AddSubtree(
     aParent->AddChildAt(aIdxInParent, newProxy);
     newProxy->SetParent(aParent);
   } else {
+    if (!aria::IsRoleMapIndexValid(newChild.RoleMapEntryIndex())) {
+      MOZ_ASSERT_UNREACHABLE("Invalid role map entry index");
+      return 0;
+    }
     newProxy = new RemoteAccessible(
         newChild.ID(), aParent, this, newChild.Role(), newChild.Type(),
         newChild.GenericTypes(), newChild.RoleMapEntryIndex());
@@ -246,8 +251,18 @@ mozilla::ipc::IPCResult DocAccessibleParent::RecvHideEvent(
     return IPC_OK();
   }
 
+#ifdef XP_WIN
+  WeakPtr<RemoteAccessible> parent = root->RemoteParent();
+#else
   RemoteAccessible* parent = root->RemoteParent();
+#endif
   ProxyShowHideEvent(root, parent, false, aFromUser);
+#ifdef XP_WIN
+  if (!parent) {
+    MOZ_ASSERT(!StaticPrefs::accessibility_cache_enabled_AtStartup());
+    return IPC_FAIL(this, "Parent removed while removing child");
+  }
+#endif
 
   RefPtr<xpcAccHideEvent> event = nullptr;
   if (nsCoreUtils::AccEventObserversExist()) {
@@ -726,7 +741,12 @@ ipc::IPCResult DocAccessibleParent::AddChildDoc(DocAccessibleParent* aChildDoc,
     return IPC_FAIL(this, "binding to nonexistant proxy!");
   }
 
+#ifdef XP_WIN
+  WeakPtr<RemoteAccessible> outerDoc = e->mProxy;
+#else
   RemoteAccessible* outerDoc = e->mProxy;
+#endif
+
   MOZ_ASSERT(outerDoc);
 
   // OuterDocAccessibles are expected to only have a document as a child.
@@ -763,11 +783,13 @@ ipc::IPCResult DocAccessibleParent::AddChildDoc(DocAccessibleParent* aChildDoc,
     if (bridge) {
 #if defined(XP_WIN)
       if (!StaticPrefs::accessibility_cache_enabled_AtStartup()) {
+        RefPtr<DocAccessibleParent> thisDoc = this;
+        RefPtr<DocAccessibleParent> childDoc = aChildDoc;
         // Send a COM proxy for the embedded document to the embedder process
         // hosting the iframe. This will be returned as the child of the
         // embedder OuterDocAccessible.
         RefPtr<IDispatch> docAcc;
-        aChildDoc->GetCOMInterface((void**)getter_AddRefs(docAcc));
+        childDoc->GetCOMInterface((void**)getter_AddRefs(docAcc));
         MOZ_ASSERT(docAcc);
         if (docAcc) {
           RefPtr<IDispatch> docWrapped(
@@ -777,27 +799,39 @@ ipc::IPCResult DocAccessibleParent::AddChildDoc(DocAccessibleParent* aChildDoc,
           IDispatchHolder docHolder(std::move(docPtr));
           if (bridge->SendSetEmbeddedDocAccessibleCOMProxy(docHolder)) {
 #  if defined(MOZ_SANDBOX)
-            aChildDoc->mDocProxyStream = docHolder.GetPreservedStream();
+            childDoc->mDocProxyStream = docHolder.GetPreservedStream();
 #  endif  // defined(MOZ_SANDBOX)
           }
         }
+        if (!outerDoc) {
+          return IPC_FAIL(this, "OuterDoc removed while adding child doc");
+        }
+        if (childDoc->IsShutdown()) {
+          return IPC_FAIL(this, "Child doc removed while adding it");
+        }
         // Send a COM proxy for the embedder OuterDocAccessible to the embedded
         // document process. This will be returned as the parent of the
         // embedded document.
-        aChildDoc->SendParentCOMProxy(outerDoc);
+        childDoc->SendParentCOMProxy(outerDoc);
+        if (childDoc->IsShutdown()) {
+          return IPC_FAIL(this, "Child doc removed while adding it");
+        }
         if (nsWinUtils::IsWindowEmulationStarted()) {
           // The embedded document should use the same emulated window handle as
           // its embedder. It will return the embedder document (not a window
           // accessible) as the parent accessible, so we pass a null accessible
           // when sending the window to the embedded document.
-          Unused << aChildDoc->SendEmulatedWindow(
+          Unused << childDoc->SendEmulatedWindow(
               reinterpret_cast<uintptr_t>(mEmulatedWindowHandle), nullptr);
         }
+        if (thisDoc->IsShutdown()) {
+          return IPC_FAIL(this, "Parent doc removed while adding child doc");
+        }
         // Send a COM proxy for the top level document to the embedded document
         // process. This will be returned when the client calls QueryService
         // with SID_IAccessibleContentDocument on an accessible in the embedded
         // document.
-        DocAccessibleParent* topDoc = this;
+        DocAccessibleParent* topDoc = thisDoc;
         while (DocAccessibleParent* parentDoc = topDoc->ParentDoc()) {
           topDoc = parentDoc;
         }
@@ -811,13 +845,19 @@ ipc::IPCResult DocAccessibleParent::AddChildDoc(DocAccessibleParent* aChildDoc,
           IAccessibleHolder::COMPtrType topDocPtr(
               mscom::ToProxyUniquePtr(std::move(topDocWrapped)));
           IAccessibleHolder topDocHolder(std::move(topDocPtr));
-          if (aChildDoc->SendTopLevelDocCOMProxy(topDocHolder)) {
+          if (childDoc->SendTopLevelDocCOMProxy(topDocHolder)) {
 #  if defined(MOZ_SANDBOX)
             aChildDoc->mTopLevelDocProxyStream =
                 topDocHolder.GetPreservedStream();
 #  endif  // defined(MOZ_SANDBOX)
           }
         }
+        if (!outerDoc) {
+          return IPC_FAIL(this, "OuterDoc removed while adding child doc");
+        }
+        if (childDoc->IsShutdown()) {
+          return IPC_FAIL(this, "Child doc removed while adding it");
+        }
       }
       if (nsWinUtils::IsWindowEmulationStarted()) {
         aChildDoc->SetEmulatedWindowHandle(mEmulatedWindowHandle);

accessible/ipc/RemoteAccessibleBase.h

@@ -11,6 +11,7 @@
 #include "mozilla/a11y/CacheConstants.h"
 #include "mozilla/a11y/HyperTextAccessibleBase.h"
 #include "mozilla/a11y/Role.h"
+#include "mozilla/WeakPtr.h"
 #include "AccAttributes.h"
 #include "nsIAccessibleText.h"
 #include "nsIAccessibleTypes.h"
@@ -27,7 +28,13 @@ class RemoteAccessible;
 enum class RelationType;
 
 template <class Derived>
+#ifdef XP_WIN
+class RemoteAccessibleBase : public Accessible,
+                             public HyperTextAccessibleBase,
+                             public SupportsWeakPtr {
+#else
 class RemoteAccessibleBase : public Accessible, public HyperTextAccessibleBase {
+#endif
  public:
   virtual ~RemoteAccessibleBase() { MOZ_ASSERT(!mWrapper); }
 

accessible/ipc/win/RemoteAccessible.cpp

@@ -38,7 +38,7 @@ bool RemoteAccessible::GetCOMInterface(void** aOutAccessible) const {
   // methods here in RemoteAccessible, causing infinite recursion.
   MOZ_ASSERT(!StaticPrefs::accessibility_cache_enabled_AtStartup());
   if (!mCOMProxy && mSafeToRecurse) {
-    RemoteAccessible* thisPtr = const_cast<RemoteAccessible*>(this);
+    WeakPtr<RemoteAccessible> thisPtr = const_cast<RemoteAccessible*>(this);
     // See if we can lazily obtain a COM proxy
     MsaaAccessible* msaa = MsaaAccessible::GetFrom(thisPtr);
     bool isDefunct = false;
@@ -48,7 +48,12 @@ bool RemoteAccessible::GetCOMInterface(void** aOutAccessible) const {
     VARIANT realId = {{{VT_I4}}};
     realId.ulVal = msaa->GetExistingID();
     MOZ_DIAGNOSTIC_ASSERT(realId.ulVal != CHILDID_SELF);
-    thisPtr->mCOMProxy = msaa->GetIAccessibleFor(realId, &isDefunct);
+    RefPtr<IAccessible> proxy = msaa->GetIAccessibleFor(realId, &isDefunct);
+    if (!thisPtr) {
+      *aOutAccessible = nullptr;
+      return false;
+    }
+    thisPtr->mCOMProxy = proxy;
   }
 
   RefPtr<IAccessible> addRefed = mCOMProxy;

accessible/ipc/win/handler/AccessibleHandler.cpp

@@ -687,6 +687,25 @@ AccessibleHandler::get_accChildCount(long* pcountChildren) {
   }
 
   BEGIN_CACHE_ACCESS;
+  if (mCachedData.mDynamicData.mIA2Role == ROLE_SYSTEM_DOCUMENT) {
+    RefPtr<AccessibleHandlerControl> ctl(
+        gControlFactory.GetOrCreateSingleton());
+    if (!ctl) {
+      return E_OUTOFMEMORY;
+    }
+    if (ctl->IsA11ySuppressedForClipboardCopy()) {
+      // Bug 1798098: Windows Suggested Actions (introduced in Windows 11
+      // 22H2) might walk the document a11y tree using UIA whenever anything
+      // is copied to the clipboard. This causes an unacceptable hang,
+      // particularly when the cache is disabled. Even though we lie about the
+      // selection in nSelections, it falls back to a normal tree walk on the
+      // document if it doesn't get a proper text selection. Prevent that by
+      // returning a 0 child count on the document.
+      *pcountChildren = 0;
+      return S_OK;
+    }
+  }
+
   GET_FIELD(mChildCount, *pcountChildren);
   return S_OK;
 }
@@ -1824,7 +1843,30 @@ AccessibleHandler::get_nSelections(long* nSelections) {
     return hr;
   }
 
-  return mIAHypertextPassThru->get_nSelections(nSelections);
+  hr = mIAHypertextPassThru->get_nSelections(nSelections);
+  if (SUCCEEDED(hr) && *nSelections == 0 && HasPayload()) {
+    BEGIN_CACHE_ACCESS;
+    if (mCachedData.mDynamicData.mIA2Role == ROLE_SYSTEM_DOCUMENT) {
+      RefPtr<AccessibleHandlerControl> ctl(
+          gControlFactory.GetOrCreateSingleton());
+      if (!ctl) {
+        return E_OUTOFMEMORY;
+      }
+      if (ctl->IsA11ySuppressedForClipboardCopy()) {
+        // Bug 1798098: Windows Suggested Actions (introduced in Windows 11
+        // 22H2) might walk the document a11y tree using UIA whenever anything
+        // is copied to the clipboard. This causes an unacceptable hang,
+        // particularly when the cache is disabled. It walks using
+        // IAccessibleText/IAccessibleHyperText if the document reports no
+        // selection, so we lie here and say that there is a selection even
+        // though there isn't. It will subsequently call get_selection, which
+        // will fail, but this hack here seems to be enough to avoid further
+        // text calls.
+        *nSelections = 1;
+      }
+    }
+  }
+  return hr;
 }
 
 HRESULT

accessible/ipc/win/handler/AccessibleHandlerControl.cpp

@@ -201,5 +201,21 @@ HRESULT AccessibleHandlerControl::GetCachedAccessible(
   return S_OK;
 }
 
+HRESULT AccessibleHandlerControl::SuppressA11yForClipboardCopy() {
+  mA11yClipboardCopySuppressionStartTime = ::GetTickCount();
+  return S_OK;
+}
+
+bool AccessibleHandlerControl::IsA11ySuppressedForClipboardCopy() {
+  // Must be kept in sync with kSuppressTimeout in
+  // accessible/windows/msaa/Compatibility.cpp.
+  constexpr DWORD kSuppressTimeout = 1500;  // ms
+  if (!mA11yClipboardCopySuppressionStartTime) {
+    return false;
+  }
+  return ::GetTickCount() - mA11yClipboardCopySuppressionStartTime <
+         kSuppressTimeout;
+}
+
 }  // namespace a11y
 }  // namespace mozilla

accessible/ipc/win/handler/AccessibleHandlerControl.h

@@ -62,6 +62,7 @@ class AccessibleHandlerControl final : public IHandlerControl {
   STDMETHODIMP OnTextChange(long aHwnd, long aIA2UniqueId,
                             VARIANT_BOOL aIsInsert,
                             IA2TextSegment* aText) override;
+  STDMETHODIMP SuppressA11yForClipboardCopy() override;
 
   uint32_t GetCacheGen() const { return mCacheGen; }
 
@@ -75,6 +76,8 @@ class AccessibleHandlerControl final : public IHandlerControl {
   void CacheAccessible(long aUniqueId, AccessibleHandler* aAccessible);
   HRESULT GetCachedAccessible(long aUniqueId, AccessibleHandler** aAccessible);
 
+  bool IsA11ySuppressedForClipboardCopy();
+
  private:
   AccessibleHandlerControl();
   ~AccessibleHandlerControl() = default;
@@ -87,6 +90,9 @@ class AccessibleHandlerControl final : public IHandlerControl {
   // We can't use Gecko APIs in this dll, hence the use of std::unordered_map.
   typedef std::unordered_map<long, RefPtr<AccessibleHandler>> AccessibleCache;
   AccessibleCache mAccessibleCache;
+  // Time when SuppressA11yForClipboardCopy() was called, as returned by
+  // ::GetTickCount().
+  DWORD mA11yClipboardCopySuppressionStartTime = 0;
 };
 
 extern mscom::SingletonFactory<AccessibleHandlerControl> gControlFactory;