[Regression]: Firefox page crashes on getByRole with a name when aria-labelledby is also read in the main world

オープン
  • 何か問題がありますか？
#43,967 コメント 3 件 リアクション 0 件 担当者 0 名 GitHub で見る

メンテナーはふだん 1 日以内に返信

まだ誰も着手していません。

評価

難易度
3/5
見積もり時間
1〜2日
初心者へのやさしさ
45/100
issue の種類
バグ
明瞭さ
明確に書かれている
活発さ
活発
技術スタック
playwright, typescript
領域
backend, testing-qa

調査の方向性

Start with the accessible name resolution used by getByRole and the aria-labelledby handling that reads ariaLabelledByElements; the issue gives a minimal reproducer and identifies the failing Firefox behavior. Reproduce with the linked project and compare the main world and utility world read paths. Done means the regression test passes in Firefox without breaking the existing control cases; the reporter has a proposed change ready, so coordinate with them before taking it on.

索引モデルが issue の本文から書いたものです。

説明

needs-triage
Last Good Version

1.64.1

First Bad Version

1.65.0

Steps to reproduce
  1. Clone https://github.com/bartech-lab/firefox-aria-reflection-crash
  2. npm ci
  3. npx playwright install firefox
  4. npm test
  5. You should see 2 failures with "Page crashed", and 3 control tests passing

The failing test is:

await page.setContent(`<span id="l">Save</span><button id="b" aria-labelledby="l"></button>`);
await page.evaluate(() => document.getElementById('b').ariaLabelledByElements);
await page.getByRole('button', { name: 'Save' }).click({ trial: true });
Expected behavior

The test passes, as it does on Chromium and WebKit.

Actual behavior

locator.click: Page crashed. The Firefox content process exits on signal 11.

20 of 20 runs crash, in either read order. The controls pass 30 of 30: main world twice, utility world twice, and no aria-labelledby. It also reproduces on main at 58d69dcc3.

The test does not need its own read. A real suite hit this in two ways:

  • locator.dispatchEvent() resolves getByRole in the main world, then an action or assertion resolves it in the utility world.
  • getByRole in the utility world, then an @axe-core/playwright scan. A plain page.evaluate of the property crashes at the same point. I did not identify which axe call crashes.
Additional context

This is a Firefox bug, which #43577 exposed by reading element.ariaLabelledByElements in the utility world. It also crashes stock Firefox 159.0.1 and Nightly 162.0a1 with an extension content script: https://bugzilla.mozilla.org/show_bug.cgi?id=2090055, with a tested patch. Playwright's Firefox 157 crashes too when a custom selector engine does the same read.

I would like to work on this. I have a change ready for a PR if you approve it:

const attribute = element.getAttribute('aria-labelledby');
const refs = attribute ? getIdRefs(element, attribute) : element.ariaLabelledByElements;

One added line in SE-060 crashes Firefox without this change and passes with it. npm run flint passes.

Limit: this does not cover references set from script. If a page sets ariaLabelledByElements and reads it back, the attribute is empty, so Playwright still reads the property and Firefox still crashes. Only the Firefox fix closes that case, so you may prefer to carry it in your Firefox patches, which I did not try.

Environment
  System:
    OS: Linux 7.2 EndeavourOS
    CPU: (16) x64 AMD Ryzen 7 9800X3D 8-Core Processor
    Memory: 37.05 GB / 60.20 GB
    Container: Yes
  Binaries:
    Node: 26.13.0 - /usr/bin/node
    npm: 12.2.2 - /usr/bin/npm
    Deno: 2.9.8 - /usr/bin/deno
  Languages:
    Bash: 5.3.20 - /usr/bin/bash
  npmPackages:
    @playwright/test: 1.65.0 => 1.65.0
主要言語
TypeScript
スター
99.1k
フォーク
6.8k
平均マージ
16時間 20分
マージ済み PR（30日）
324

環境構築

はじめの一歩

  1. issue を最後まで読み、次にプロジェクトのコントリビューションガイドを読みます。
  2. 着手することを issue にコメントします — 二人が同じ作業をするのを防げます。
  3. リポジトリをフォークし、ブランチを切って変更します。
  4. issue 番号を参照したプルリクエストを送ります。

microsoft/playwright のほかの issue

microsoft/playwright の issue をすべて見る

似ている issue

TypeScript の issue をもっと見る

新しい issue をメールで受け取る

初心者向けの GitHub issue を短くまとめたダイジェスト。