Accessibility crash while closing tabs or restoring a session

Browser crash https://brave.sp.backtrace.io/p/brave/debug?filters=((callstack%2Ccontains%2CaccessibilityAttributedStringForRange)%2C(ver%2Cregex%2C"8[7|8|9].*")%2Cptype%3Dbrowser)&debug=(c25f28,0,0)

[ 05 ] std::__terminate(void (*)())
[ 06 ] __cxxabiv1::failed_throw(__cxxabiv1::__cxa_exception*)
[ 07 ] __cxa_throw
[ 08 ] 0x7fff6ca756ed
[ 09 ] 0x7fff3625b33c
[ 10 ] -[AXPlatformNodeCocoa accessibilityAttributedStringForRange:]

Steps to Reproduce

1. System preferences -> Accessibility -> Keyboard -> Enable Typing feedback
2. Login to GMail, open second tab (Cmd-T) with gmail, close it (Cmd-W). Sometimes you need to open several tabs with GMail and quickly close them one by one
3. Observe a crash
4. Restart a browser, try to restore tabs
5. Observe a crash

Reproduces how often:

Easily reproduced/Intermittent issue/No steps to reproduce

Brave version (brave://version info)

Brave	1.19.86 Chromium: 88.0.4324.96 (Official Build) (x86_64)
Revision	68dba2d8a0b149a1d3afac56fa74648032bcf46b-refs/branch-heads/4324@{#1784}
OS	macOS Version 10.15.7 (Build 19H114)

and newer, tested on

Brave	1.21.28 Chromium: 88.0.4324.96 (Official Build) nightly (x86_64)
Revision	68dba2d8a0b149a1d3afac56fa74648032bcf46b-refs/branch-heads/4324@{#1784}
OS	macOS Version 10.15.7 (Build 19H114)

Version/Channel Information:

• Can you reproduce this issue with the current release? yes
• Can you reproduce this issue with the beta channel? yes
• Can you reproduce this issue with the nightly channel? yes

Technical notes

The crash occurs in accessibilityAttributedStringForRange which is called by MacOS for different elements of the browser UI. For some reason, MacOS calls it for Tabs, and in this unfortunate case the requested string cannot be obtained. We have to figure out why this happens at all, because Chrome doesn’t look affected

[LaurenWags]

Encountered a crash on 1.21.30

Brave | 1.21.30 Chromium: 88.0.4324.96 (Official Build) nightly (x86_64)
-- | --
Revision | 68dba2d8a0b149a1d3afac56fa74648032bcf46b-refs/branch-heads/4324@{#1784}
OS | macOS Version 10.15.7 (Build 19H15)

Enabled Typing Feedback in Accessibility settings (also enabled all 4 options for this):

STR:

1. Clean profile
2. Login to mail.google.com
3. Quickly open a new tab using cmd + t and type m immediately followed by pressing return.
4. Repeat step 3 quickly several times
5. Brave crashed.

Crash Report ID: 421a0000-9cc8-c705-0000-000000000000

[kjozwiak]

Attempted to reproduce the crash with 1.21.35 CR: 88.0.4324.96 but couldn’t reproduce. After speaking with @iefremov, this could be a Catalina vs Big Sur issue. Going to work with @LaurenWags to see if she can reproduce as she’s on Catalina as well.

If QA can’t reproduce @iefremov, we might just need to uplift and have @iefremov verify it once we uplift and get a 1.19.x build.