Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Vbuf backend crashes when moving options between list boxes #10175

jcsteh opened this issue Sep 9, 2019 · 2 comments · Fixed by #10188

Vbuf backend crashes when moving options between list boxes #10175

jcsteh opened this issue Sep 9, 2019 · 2 comments · Fixed by #10188


Copy link

jcsteh commented Sep 9, 2019

Steps to reproduce:

  1. Open this test case in Firefox:
    data:text/html,<body onkeydown="if (event.key == 'ArrowDown') { let oldActive = owner.getAttribute('aria-activedescendant'); let newActive = oldActive == 'item1' ? 'item2' : 'item1'; owner.setAttribute('aria-owns', newActive); owner.setAttribute('aria-activedescendant', newActive); }"><div role="listbox"><div id="item1" role="option"><div>item1</div></div><div id="item2" role="option"><div>item2</div></div></div><div id="owner" role="listbox" tabindex="0" aria-owns="item1" aria-activedescendant="item1"><div></div></div></body>
  2. Tab so that the list box option has focus.
  3. Switch to focus mode.
  4. Press down arrow. If no crash, press down arrow again.

Actual behavior:

Crash in VBufStorage_buffer_t::getLineOffsets. For example:

Expected behavior:

No crash.

System configuration

NVDA installed/portable/running from source:


NVDA version:


Windows version:

Windows 10 Version 1903 (OS Build 18362.10015)

Name and version of other software in use when reproducing the issue:

Firefox nightly 71.0a1 (2019-09-08) (64-bit)

Other questions

Does the issue still occur after restarting your PC?


Have you tried any other versions of NVDA? If so, please report their behaviors.


Additional info

I wrote this test case in attempting to distill an issue experienced on Gmail. The Gmail crash occurs in VBufStorage_buffer_t::deleteSubtree. While different, I'm guessing it's related; these are both to do with buffer corruption. I'm hoping a fix for the test case above will deal with the Gmail crash too. If not, I can file a separate bug for the Gmail crash.

The Gmail crash was reported by @MarcoZehe in . Here are the STR he provided (and I can immediately reproduce this too):

  1. Log into Gmail.
  2. Open a conversation.
  3. Open the More menu inside the conversation view, and choose "Filter hese messages".
  4. Accept whatever it presents you and choose the Create Filter link at the bottom.
  5. On the next page, check the box that says Apply Label.
  6. Tab once to the Choose Label dropdown, and choose a label by arrowing to it and pressing Enter.
    • Expected: Focus should return to the closed dropdown where the label has been chosen.
    • Actual: Either Firefox crashes, and NVDA keeps running, or Firefox and NVDA close down alltogether, and no crash reporter comes up. I had both happen to me, and one instance where only Firefox crashed, brought up the above crash report.

CC @michaelDCurran.

Copy link
Contributor Author

jcsteh commented Sep 9, 2019

Note that this is specific to list boxes, which suggests it is triggered by an event on the selected list box option causing the parent to be re-rendered (requiresParentUpdate is set to true for the selected list box option). My guess is that we re-render the parent, which will render a moved child option, but that moved child option hasn't yet been moved from its old place in the buffer yet... or something.

Copy link

lukaszgo1 commented Sep 9, 2019

Probably related to #9402

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
None yet
None yet

Successfully merging a pull request may close this issue.

4 participants