112396 2013-03-14 17:58:29 -0700 AX: Crash when removing aria-menu item from DOM 2013-03-14 19:10:56 -0700 1 1 1 Unclassified WebKit Accessibility 528+ (Nightly build) Unspecified Unspecified RESOLVED FIXED P2 Normal --- 1 cfleizach cfleizach aboxhall apinheiro dmazzoni jdiggs thorton webkit.review.bot oldest_to_newest 855613 0 cfleizach 2013-03-14 17:58:29 -0700 If you have a aria menu in the tree, then removing it from the DOM leads to a crash NULL access crash > 1 com.apple.WebCore 0x7fff8ee43c4d WebCore::AccessibilityRenderObject::parentObject() const + 0x7d 2 com.apple.WebCore 0x7fff8ee43bb6 WebCore::AccessibilityRenderObject::ariaIsHidden() const + 0x86 3 com.apple.WebCore 0x7fff8f2291e2 WebCore::AccessibilityRenderObject::accessibilityIsIgnoredBase() const + 0x52 4 com.apple.WebCore 0x7fff8f234d07 WebCore::AccessibilityRenderObject::computeAccessibilityIsIgnored() const + 0x17 5 com.apple.WebCore 0x7fff8f234264 WebCore::AccessibilityObject::accessibilityIsIgnored() const + 0x84 6 com.apple.WebCore 0x7fff8f228600 WebCore::AXObjectCache::recomputeIsIgnored(WebCore::RenderObject*) + 0x20 7 com.apple.WebCore 0x7fff8ee02e02 WebCore::RenderBlock::removeChild(WebCore::RenderObject*) + 0x3d2 8 com.apple.WebCore 0x7fff8f94691d WebCore::RenderObject::willBeDestroyed() + 0xcd 9 com.apple.WebCore 0x7fff8f996e2e WebCore::RenderText::willBeDestroyed() + 0xae 10 com.apple.WebCore 0x7fff8ee02992 WebCore::RenderObject::destroy() + 0x12 11 com.apple.WebCore 0x7fff8ede5890 WebCore::Node::detach() + 0x40 12 com.apple.WebCore 0x7fff8ede582c WebCore::ContainerNode::detach() + 0x1c 13 com.apple.WebCore 0x7fff8ede57dd WebCore::Element::detach() + 0x1ed 14 com.apple.WebCore 0x7fff8ede582c WebCore::ContainerNode::detach() + 0x1c 15 com.apple.WebCore 0x7fff8ede57dd WebCore::Element::detach() + 0x1ed 16 com.apple.WebCore 0x7fff8ede582c WebCore::ContainerNode::detach() + 0x1c 17 com.apple.WebCore 0x7fff8ede57dd WebCore::Element::detach() + 0x1ed 18 com.apple.WebCore 0x7fff8ede582c WebCore::ContainerNode::detach() + 0x1c 19 com.apple.WebCore 0x7fff8ede57dd WebCore::Element::detach() + 0x1ed 20 com.apple.WebCore 0x7fff8ede582c WebCore::ContainerNode::detach() + 0x1c 855616 1 193212 cfleizach 2013-03-14 18:01:51 -0700 Created attachment 193212 patch 855617 2 cfleizach 2013-03-14 18:02:34 -0700 Adding Tim to help with review 855638 3 193212 webkit.review.bot 2013-03-14 19:10:53 -0700 Comment on attachment 193212 patch Clearing flags on attachment: 193212 Committed r145866: <http://trac.webkit.org/changeset/145866> 855639 4 webkit.review.bot 2013-03-14 19:10:56 -0700 All reviewed patches have been landed. Closing bug. 193212 2013-03-14 18:01:51 -0700 2013-03-14 19:10:52 -0700 patch patch text/plain 4421 cfleizach SW5kZXg6IFNvdXJjZS9XZWJDb3JlL0NoYW5nZUxvZwo9PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBTb3VyY2UvV2Vi Q29yZS9DaGFuZ2VMb2cJKHJldmlzaW9uIDE0NTg2MykKKysrIFNvdXJjZS9XZWJDb3JlL0NoYW5n ZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDE5IEBACisyMDEzLTAzLTE0ICBDaHJpcyBG bGVpemFjaCAgPGNmbGVpemFjaEBhcHBsZS5jb20+CisKKyAgICAgICAgQVg6IENyYXNoIHdoZW4g cmVtb3ZpbmcgYXJpYS1tZW51IGl0ZW0gZnJvbSBET00KKyAgICAgICAgaHR0cHM6Ly9idWdzLndl YmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTExMjM5NgorCisgICAgICAgIFJldmlld2VkIGJ5IE5P Qk9EWSAoT09QUyEpLgorCisgICAgICAgIFByZXZlbnQgbmlsIGFjY2VzcyB0byBpdGVtcyBpbiB0 aGUgQVJJQSBtZW51IGZsb3cgd2hlbiBkZWxldGluZworICAgICAgICBvYmplY3RzIGZyb20gdGhl IERPTS4KKworICAgICAgICBUZXN0OiBhY2Nlc3NpYmlsaXR5L21lbnUtaXRlbS1jcmFzaC5odG1s CisKKyAgICAgICAgKiBhY2Nlc3NpYmlsaXR5L0FjY2Vzc2liaWxpdHlOb2RlT2JqZWN0LmNwcDoK KyAgICAgICAgKFdlYkNvcmU6OnNpYmxpbmdXaXRoQXJpYVJvbGUpOgorICAgICAgICAoV2ViQ29y ZTo6QWNjZXNzaWJpbGl0eU5vZGVPYmplY3Q6Om1lbnVCdXR0b25Gb3JNZW51KToKKwogMjAxMy0w My0xNCAgQnJhbmRvbiBKb25lcyAgPGJham9uZXNAZ29vZ2xlLmNvbT4KIAogICAgICAgICBDaGVj ayB0byBlbnN1cmUgTXVsdGlzYW1wbGVSZW5kZXJidWZmZXIgY3JlYXRpb24gc3VjY2VlZHMKSW5k ZXg6IFNvdXJjZS9XZWJDb3JlL2FjY2Vzc2liaWxpdHkvQWNjZXNzaWJpbGl0eU5vZGVPYmplY3Qu Y3BwCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT0KLS0tIFNvdXJjZS9XZWJDb3JlL2FjY2Vzc2liaWxpdHkvQWNjZXNzaWJp bGl0eU5vZGVPYmplY3QuY3BwCShyZXZpc2lvbiAxNDU4NTYpCisrKyBTb3VyY2UvV2ViQ29yZS9h Y2Nlc3NpYmlsaXR5L0FjY2Vzc2liaWxpdHlOb2RlT2JqZWN0LmNwcAkod29ya2luZyBjb3B5KQpA QCAtMTA5MSw3ICsxMDkxLDExIEBACiAKIHN0YXRpYyBFbGVtZW50KiBzaWJsaW5nV2l0aEFyaWFS b2xlKFN0cmluZyByb2xlLCBOb2RlKiBub2RlKQogewotICAgIGZvciAoTm9kZSogc2libGluZyA9 IG5vZGUtPnBhcmVudE5vZGUoKS0+Zmlyc3RDaGlsZCgpOyBzaWJsaW5nOyBzaWJsaW5nID0gc2li bGluZy0+bmV4dFNpYmxpbmcoKSkgeworICAgIE5vZGUqIHBhcmVudCA9IG5vZGUtPnBhcmVudE5v ZGUoKTsKKyAgICBpZiAoIXBhcmVudCkKKyAgICAgICAgcmV0dXJuIDA7CisgICAgCisgICAgZm9y IChOb2RlKiBzaWJsaW5nID0gcGFyZW50LT5maXJzdENoaWxkKCk7IHNpYmxpbmc7IHNpYmxpbmcg PSBzaWJsaW5nLT5uZXh0U2libGluZygpKSB7CiAgICAgICAgIGlmIChzaWJsaW5nLT5pc0VsZW1l bnROb2RlKCkpIHsKICAgICAgICAgICAgIGNvbnN0IEF0b21pY1N0cmluZyYgc2libGluZ0FyaWFS b2xlID0gdG9FbGVtZW50KHNpYmxpbmcpLT5nZXRBdHRyaWJ1dGUocm9sZUF0dHIpOwogICAgICAg ICAgICAgaWYgKGVxdWFsSWdub3JpbmdDYXNlKHNpYmxpbmdBcmlhUm9sZSwgcm9sZSkpCkBAIC0x MTMwLDcgKzExMzQsNyBAQAogICAgIGlmIChtZW51SXRlbSkgewogICAgICAgICAvLyBBUklBIGp1 c3QgaGFzIGdlbmVyaWMgbWVudSBpdGVtcy4gQXBwS2l0IG5lZWRzIHRvIGtub3cgaWYgdGhpcyBp cyBhIHRvcCBsZXZlbCBpdGVtcyBsaWtlIE1lbnVCYXJCdXR0b24gb3IgTWVudUJhckl0ZW0KICAg ICAgICAgQWNjZXNzaWJpbGl0eU9iamVjdCogbWVudUl0ZW1BWCA9IGF4T2JqZWN0Q2FjaGUoKS0+ Z2V0T3JDcmVhdGUobWVudUl0ZW0pOwotICAgICAgICBpZiAobWVudUl0ZW1BWC0+aXNNZW51QnV0 dG9uKCkpCisgICAgICAgIGlmIChtZW51SXRlbUFYICYmIG1lbnVJdGVtQVgtPmlzTWVudUJ1dHRv bigpKQogICAgICAgICAgICAgcmV0dXJuIG1lbnVJdGVtQVg7CiAgICAgfQogICAgIHJldHVybiAw OwpJbmRleDogTGF5b3V0VGVzdHMvQ2hhbmdlTG9nCj09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIExheW91dFRlc3Rz L0NoYW5nZUxvZwkocmV2aXNpb24gMTQ1ODYzKQorKysgTGF5b3V0VGVzdHMvQ2hhbmdlTG9nCSh3 b3JraW5nIGNvcHkpCkBAIC0xLDMgKzEsMTMgQEAKKzIwMTMtMDMtMTQgIENocmlzIEZsZWl6YWNo ICA8Y2ZsZWl6YWNoQGFwcGxlLmNvbT4KKworICAgICAgICBBWDogQ3Jhc2ggd2hlbiByZW1vdmlu ZyBhcmlhLW1lbnUgaXRlbSBmcm9tIERPTQorICAgICAgICBodHRwczovL2J1Z3Mud2Via2l0Lm9y Zy9zaG93X2J1Zy5jZ2k/aWQ9MTEyMzk2CisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChP T1BTISkuCisKKyAgICAgICAgKiBhY2Nlc3NpYmlsaXR5L21lbnUtaXRlbS1jcmFzaC1leHBlY3Rl ZC50eHQ6IEFkZGVkLgorICAgICAgICAqIGFjY2Vzc2liaWxpdHkvbWVudS1pdGVtLWNyYXNoLmh0 bWw6IEFkZGVkLgorCiAyMDEzLTAzLTE0ICBLZW5uZXRoIFJ1c3NlbGwgIDxrYnJAZ29vZ2xlLmNv bT4KIAogICAgICAgICBVbnJldmlld2VkIHRlc3QgZXhwZWN0YXRpb25zIHVwZGF0ZS4gRXhwYW5k ZWQgc3VwcHJlc3Npb24uCkluZGV4OiBMYXlvdXRUZXN0cy9hY2Nlc3NpYmlsaXR5L21lbnUtaXRl bS1jcmFzaC1leHBlY3RlZC50eHQKPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gTGF5b3V0VGVzdHMvYWNjZXNzaWJp bGl0eS9tZW51LWl0ZW0tY3Jhc2gtZXhwZWN0ZWQudHh0CShyZXZpc2lvbiAwKQorKysgTGF5b3V0 VGVzdHMvYWNjZXNzaWJpbGl0eS9tZW51LWl0ZW0tY3Jhc2gtZXhwZWN0ZWQudHh0CSh3b3JraW5n IGNvcHkpCkBAIC0wLDAgKzEsMTAgQEAKK1RoaXMgdGVzdHMgdGhhdCBkZWxldGluZyBhIEFSSUEg bWVudSBhbmQgY2hpbGRyZW4gZG8gbm90IGNhdXNlIGEgY3Jhc2guCisKK09uIHN1Y2Nlc3MsIHlv dSB3aWxsIHNlZSBhIHNlcmllcyBvZiAiUEFTUyIgbWVzc2FnZXMsIGZvbGxvd2VkIGJ5ICJURVNU IENPTVBMRVRFIi4KKworCitQQVNTIC0gVGhlcmUgd2FzIG5vIGNyYXNoIHdoZW4gcmVtb3Zpbmcg dGhlIEFSSUEgbWVudSBmcm9tIHRoZSBET00uCitQQVNTIHN1Y2Nlc3NmdWxseVBhcnNlZCBpcyB0 cnVlCisKK1RFU1QgQ09NUExFVEUKKwpJbmRleDogTGF5b3V0VGVzdHMvYWNjZXNzaWJpbGl0eS9t ZW51LWl0ZW0tY3Jhc2guaHRtbAo9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBMYXlvdXRUZXN0cy9hY2Nlc3NpYmls aXR5L21lbnUtaXRlbS1jcmFzaC5odG1sCShyZXZpc2lvbiAwKQorKysgTGF5b3V0VGVzdHMvYWNj ZXNzaWJpbGl0eS9tZW51LWl0ZW0tY3Jhc2guaHRtbAkod29ya2luZyBjb3B5KQpAQCAtMCwwICsx LDM1IEBACis8IURPQ1RZUEUgSFRNTCBQVUJMSUMgIi0vL0lFVEYvL0RURCBIVE1MLy9FTiI+Cis8 aHRtbD4KKzxoZWFkPgorPHNjcmlwdCBzcmM9Ii4uL2Zhc3QvanMvcmVzb3VyY2VzL2pzLXRlc3Qt cHJlLmpzIj48L3NjcmlwdD4KKzwvaGVhZD4KKzxib2R5IGlkPSJib2R5Ij4KKworPGRpdiBpZD0i Y29udGVudCIgcm9sZT0iZ3JvdXAiPgorCis8ZGl2IHJvbGU9Im1lbnUiIGlkPSJtZW51Ij4KKyA8 ZGl2IHJvbGU9Im1lbnVpdGVtIiBpZD0iaXRlbSI+YTwvZGl2PgorIDxkaXYgcm9sZT0ibWVudWl0 ZW0iPmE8L2Rpdj4KKzwvZGl2PgorCis8c2NyaXB0PgorCisgICAgZGVzY3JpcHRpb24oIlRoaXMg dGVzdHMgdGhhdCBkZWxldGluZyBhIEFSSUEgbWVudSBhbmQgY2hpbGRyZW4gZG8gbm90IGNhdXNl IGEgY3Jhc2guIik7CisKKyAgICBpZiAod2luZG93LmFjY2Vzc2liaWxpdHlDb250cm9sbGVyKSB7 CisgICAgICAKKyAgICAgICAgdmFyIGNvbnRlbnQgPSBhY2Nlc3NpYmlsaXR5Q29udHJvbGxlci5h Y2Nlc3NpYmxlRWxlbWVudEJ5SWQoIml0ZW0iKTsKKworICAgICAgICAvLyBEb24ndCBjcmFzaCEK KyAgICAgICAgZG9jdW1lbnQuZ2V0RWxlbWVudEJ5SWQoImNvbnRlbnQiKS5pbm5lckhUTUwgPSAi IjsgIAorICAgCisgICAgICAgIGRlYnVnKCJQQVNTIC0gVGhlcmUgd2FzIG5vIGNyYXNoIHdoZW4g cmVtb3ZpbmcgdGhlIEFSSUEgbWVudSBmcm9tIHRoZSBET00uIik7CisgICAgfQorCisKKzwvc2Ny aXB0PgorCis8c2NyaXB0IHNyYz0iLi4vZmFzdC9qcy9yZXNvdXJjZXMvanMtdGVzdC1wb3N0Lmpz Ij48L3NjcmlwdD4KKzwvYm9keT4KKzwvaHRtbD4KKwo=