Brave crashes during text-to-speech when speak selection is activated

[stephendonner]

Description

Brave crashes during text-to-speech when speak selection is activated

Steps to Reproduce

1. navigate to Apple menu -> System Preferences -> Accessibility -> Spoken Content
2. select Speak selection
3. click on Options...
4. change the Keyboard shortcut to something easy, like Control+=
5. open Gmail
6. compose a new message
7. enter enough text that you get a scrollbar (not sure it's necessary, but can't hurt)
8. select a bunch of text
9. now press control + +
10. interrupt the read audio by pressing control + + again

Actual result:

Crashes, in:

[ 00 ] content::BrowserAccessibility::AccessibilityPerformAction(ui::AXActionData const&)
[ 01 ] -[AXPlatformNodeCocoa setAccessibilitySelectedTextRange:]
[ 02 ] 0x7fff2325e232
[ 03 ] 0x7fff2325f5cf
[ 04 ] 0x7fff2325f3fd
[ 05 ] 0x7fff2325bfd0
[ 06 ] 0x7fff23052568
[ 07 ] 0x7fff256c6254
[ 08 ] 0x7fff256e7001
[ 09 ] 0x7fff256a593c
[ 10 ] 0x7fff20412a44
[ 11 ] 0x7fff20412925
[ 12 ] 0x7fff20410faf
[ 13 ] 0x7fff2040ff8c
[ 14 ] 0x7fff28657a83
[ 15 ] 0x7fff286577e5
[ 16 ] 0x7fff28657583
[ 17 ] 0x7fff22c19172
[ 18 ] 0x7fff22c17945
[ 19 ] __71-[BrowserCrApplication nextEventMatchingMask:untilDate:inMode:dequeue:]_block_invoke
[ 20 ] base::mac::CallWithEHFrame(void () block_pointer)
[ 21 ] -[BrowserCrApplication nextEventMatchingMask:untilDate:inMode:dequeue:]
[ 22 ] 0x7fff22c09c69
[ 23 ] base::MessagePumpNSApplication::DoRun(base::MessagePump::Delegate*)
[ 24 ] base::MessagePumpCFRunLoopBase::Run(base::MessagePump::Delegate*)
[ 25 ] base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, base::TimeDelta)
[ 26 ] <name omitted>
[ 27 ] content::BrowserMainLoop::RunMainMessageLoop()
[ 28 ] content::BrowserMainRunnerImpl::Run()
[ 29 ] content::BrowserMain(content::MainFunctionParams const&)
[ 30 ] content::ContentMainRunnerImpl::RunBrowser(content::MainFunctionParams&, bool)
[ 31 ] content::ContentMainRunnerImpl::Run(bool)
[ 32 ] content::RunContentProcess(content::ContentMainParams const&, content::ContentMainRunner*)
[ 33 ] content::ContentMain(content::ContentMainParams const&)
[ 34 ] ChromeMain
[ 35 ] main
[ 36 ] 0x7fff20335f3d

Expected result:

Text-to-speech is read out, no crash

Reproduces how often:

90%-ish?

Brave version (brave://version info)

Brave	1.31.88 Chromium: 95.0.4638.69 (Official Build) (x86_64)
Revision	6a1600ed572fedecd573b6c2b90a22fe6392a410-refs/branch-heads/4638@{#984}
OS	macOS Version 11.6.1 (Build 20G224)

[stephendonner]

In case this snippet of text makes it easier to reproduce, I've put it up at https://gist.github.com/stephendonner/1078db66495a0c8e7c3c15f6125800b2

[LaurenWags]

Brave | 1.31.88 Chromium: 95.0.4638.69 (Official Build) (x86_64)
-- | --
Revision | 6a1600ed572fedecd573b6c2b90a22fe6392a410-refs/branch-heads/4638@{#984}
OS | macOS Version 11.6.1 (Build 20G224)

Reproduced on 1.31.x, but not consistently. Did not reproduce with 1.30.x or latest Chrome (95.0.4638.69).

Note, I used the steps from https://community.brave.com/t/brave-crashing-when-using-mac-osx-text-to-speech/296486 (including changing the keyboard shortcut) to set up "Spoken selection".

1. Clean profile 1.31.88.
2. Open gmail, login.
3. Begin an email. In the email body I wrote something like:

Hello,

I hope this email finds you well.

I am trying to reproduce an issue.

4. Then I highlighted/selected the body text (either with my mouse or via Cmd+a) and selected Ctrl+` .
5. Sometimes the browser crashed, sometimes it did not and would start to be read to me.
6. For the times where the browser did not crash and began to read the text to me, I clicked the "x" on the little box that pops up when text to speech is being read.
7. Sometimes (usually) that crashed the browser for me.

Crash report IDs:

4d940100-b3da-3807-0000-000000000000
c3940100-b3da-3807-0000-000000000000
73950100-b3da-3807-0000-000000000000
75950100-b3da-3807-0000-000000000000
72950100-b3da-3807-0000-000000000000
78950100-b3da-3807-0000-000000000000
76950100-b3da-3807-0000-000000000000

[Brave-Matt]

Adding additional user report here (macOS Monterey):
https://community.brave.com/t/mac-osx-12-monterey-browser-crash-when-apple-speak-section/294261/4

[kjozwiak]

As discussed, we're going to try getting this fixed for 1.31.x - Release #4 as we're getting a decent amount of reports.

[iefremov]

there is a slightly easier repro: instead of gmail any textarea could be used.
E.g., load the following link data:text/html,<textarea>SELECT ME</textarea>, select all and hit the voice shortcut

[iefremov]

it seems we just need to backport/uplift the upstream fix https://source.chromium.org/chromium/chromium/src/+/155091ea3c05a67cf724208034d9f1130858c58c

[LaurenWags]

Using Nightly:

Brave | 1.33.64 Chromium: 96.0.4664.35 (Official Build) nightly (x86_64)
-- | --
Revision | 8df3babf8da8faa8aacb78f4848ef66a93b4944b-refs/branch-heads/4664@{#680}
OS | macOS Version 11.6.1 (Build 20G224)

Unable to reproduce the crash after ~30 min of trying. Tried both my original STR from #19230 (comment) and the suggestion from @iefremov in #19230 (comment).

[stephendonner]

I can't reproduce this any longer, using new build with CR96:

Brave	1.33.65 Chromium: 96.0.4664.35 (Official Build) nightly (x86_64)
Revision	8df3babf8da8faa8aacb78f4848ef66a93b4944b-refs/branch-heads/4664@{#680}
OS	macOS Version 11.6.1 (Build 20G224)

[LaurenWags]

Closing issue as the PR was merged to 1.31.x branch

[stephendonner]

Verified PASSED using

Brave	1.31.91 Chromium: 95.0.4638.69 (Official Build) (x86_64)
Revision	6a1600ed572fedecd573b6c2b90a22fe6392a410-refs/branch-heads/4638@{#984}
OS	macOS Version 11.6.1 (Build 20G224)

STR:

1. new profile
2. loaded data:text/html,<textarea>SELECT ME</textarea> in a tab
3. with the accessibility read-text feature still in place from Brave crashes during text-to-speech when speak selection is activated #19230 (comment), selected the text and hit control + +

Confirmed no crash; made sure I interrupted (restarted) the reading, too.

---

Verified using

Brave | 1.31.91 Chromium: 95.0.4638.69 (Official Build) (x86_64)
-- | --
Revision | 6a1600ed572fedecd573b6c2b90a22fe6392a410-refs/branch-heads/4638@{#984}
OS | macOS Version 11.6.1 (Build 20G224)

STR:

1. new profile
2. loaded data:text/html,<textarea>SELECT ME</textarea> in a tab
3. with the accessibility read-text feature still in place from Brave crashes during text-to-speech when speak selection is activated #19230 (comment), selected the text and hit control + +

Confirmed no crash; made sure I interrupted (restarted) the reading, too.

Crash was intermittent before, but reproduced fairly easily. Tried for 5-10 minutes and did not crash at all.