119333 2013-07-31 03:48:47 -0700 [EFL] REGRESSION after r153432: some accessibility tests crash. 2013-08-08 00:17:06 -0700 1 1 1 Unclassified WebKit WebKit EFL 528+ (Nightly build) Unspecified Unspecified RESOLVED FIXED P2 Normal --- 0 k.czech mario commit-queue gustavo lucas.de.marchi mario oldest_to_newest 913271 0 k.czech 2013-07-31 03:48:47 -0700 Crash log: 0xb70267b7 0xb717b288 0xb3fcf208 g_object_ref_sink 0xaf19b444 0xaf19d023 WTR::AccessibilityUIElement::allAttributes() 0xaf18ec57 WTR::JSAccessibilityUIElement::allAttributes(OpaqueJSContext const*, OpaqueJSVal ue*, OpaqueJSValue*, unsigned int, OpaqueJSValue const* const*, OpaqueJSValue const**) 0xb6c6b32b long long JSC::APICallbackFunction::call<JSC::JSCallbackFunction>(JSC::ExecState *) 0xb70182d7 0xb701f648 0xb7025f33 0xb6e402bb JSC::JITCode::execute(JSC::JSStack*, JSC::ExecState*, JSC::VM*) 913273 1 k.czech 2013-07-31 03:50:47 -0700 It seems AccessibilityUIElement does not have parent. 913275 2 mario 2013-07-31 03:56:08 -0700 Oops! I forgot to add that null check, sorry about that I'll be posting a patch right away 913283 3 207832 mario 2013-07-31 04:09:37 -0700 Created attachment 207832 Patch proposal Let's hope I have not made more mistakes 913284 4 mario 2013-07-31 04:10:18 -0700 Adding Gustavo as reviewer for this -almost- one liner patch 914159 5 207832 mario 2013-08-02 08:27:22 -0700 Comment on attachment 207832 Patch proposal Thanks for the review. Adding it to the commit queue... 914163 6 207832 commit-queue 2013-08-02 08:51:28 -0700 Comment on attachment 207832 Patch proposal Clearing flags on attachment: 207832 Committed r153651: <http://trac.webkit.org/changeset/153651> 914164 7 commit-queue 2013-08-02 08:51:31 -0700 All reviewed patches have been landed. Closing bug. 914525 8 k.czech 2013-08-05 02:30:42 -0700 I'm reopening this bug. Crash still occurs, I guess even on gtk port as well. 914534 9 k.czech 2013-08-05 03:31:53 -0700 The crash seems to appear while calling parent->platformUIElement(). This method returns PlatformUIElement type which is a GRefPtr<AtkObject>. I believe in this context: AtkObject* atkParent = parent ? parent->platformUIElement().get() : 0; platformUIElement().get(), before get() is called, the temporary PlatformUIElement is created and refGPtr(ptr) is called where ptr is a GRefPtr<AtkObject>. I think, that's way g_object_ref_sink protests. I guess platformUIElement could be specialized for ATK so that it could return AtkObject*. 914536 10 k.czech 2013-08-05 03:41:35 -0700 While testing this approach with specialized platformUIElement (I called it platformUIElementAtk()), I did find this crash, but another one appeared: 1 0xb7033767 2 0xb7186288 3 0xb3ed5627 atk_object_get_role 4 0xafb9b568 5 0xafb9d173 WTR::AccessibilityUIElement::allAttributes() 6 0xafb8ec47 WTR::JSAccessibilityUIElement::allAttributes(OpaqueJSContext const*, OpaqueJSVal ue*, OpaqueJSValue*, unsigned int, OpaqueJSValue const* const*, OpaqueJSValue const**) 7 0xb6c79292 long long JSC::APICallbackFunction::call<JSC::JSCallbackFunction>(JSC::ExecState *) 8 0xb7025035 9 0xb702c448 10 0xb7032ee3 11 0xb6e4d3cb JSC::JITCode::execute(JSC::JSStack*, JSC::ExecState*, JSC::VM*) 914537 11 k.czech 2013-08-05 03:42:40 -0700 (In reply to comment #10) > ... I did find this crash ... I did not find this crash 914580 12 mario 2013-08-05 08:19:18 -0700 Thanks Krzysztof for reporting that the issue has not been properly fixed yet. I can take a look to it tomorrow if you want, but please confirm that will be fine since I see you have been already doing some investigation and I don't want to collide with your efforts, should you were planning to work on this. 914586 13 k.czech 2013-08-05 08:27:10 -0700 (In reply to comment #12) > Thanks Krzysztof for reporting that the issue has not been properly fixed yet. I can take a look to it tomorrow if you want, but please confirm that will be fine since I see you have been already doing some investigation and I don't want to collide with your efforts, should you were planning to work on this. Yes, I will be fine if you take a look at this issue. I wrote some suppositions, but I'm not sure whether they hit the point, they may be wrong. I just looked at this briefly. 914593 14 mario 2013-08-05 08:42:39 -0700 (In reply to comment #13) > (In reply to comment #12) > > Thanks Krzysztof for reporting that the issue has not been properly fixed yet. I can take a look to it tomorrow if you want, but please confirm that will be fine since I see you have been already doing some investigation and I don't want to collide with your efforts, should you were planning to work on this. > Yes, I will be fine if you take a look at this issue. I wrote some suppositions, but I'm not sure whether they hit the point, they may be wrong. I just looked at this briefly. Ok, fair enough. I'll work tomorrow on that then. Today I'm just almost dead because of this GUADEC conference :) 915260 15 208297 mario 2013-08-07 13:42:33 -0700 Created attachment 208297 Patch proposal The problem seems to be more simple in the end: We just need to store a RefPtr for the parent instead of the raw pointer. 915266 16 208297 commit-queue 2013-08-07 14:12:31 -0700 Comment on attachment 208297 Patch proposal Clearing flags on attachment: 208297 Committed r153798: <http://trac.webkit.org/changeset/153798> 915267 17 commit-queue 2013-08-07 14:12:34 -0700 All reviewed patches have been landed. Closing bug. 915334 18 k.czech 2013-08-08 00:17:06 -0700 Thanks Mario 207832 2013-07-31 04:09:37 -0700 2013-08-07 13:42:10 -0700 Patch proposal 0001-2013-07-31-Mario-Sanchez-Prada-mario.prada-samsung.c.patch text/plain 2500 mario RnJvbSBmNThkZTUzYmEzMDgwMGU3ZTUzODg3NjEyOWJkNzM2OWVjNDVjOWRhIE1vbiBTZXAgMTcg MDA6MDA6MDAgMjAwMQpGcm9tOiBNYXJpbyBTYW5jaGV6IFByYWRhIDxtYXJpby5wcmFkYUBzYW1z dW5nLmNvbT4KRGF0ZTogV2VkLCAzMSBKdWwgMjAxMyAxMjowMToyNiArMDEwMApTdWJqZWN0OiBb UEFUQ0hdIDIwMTMtMDctMzEgIE1hcmlvIFNhbmNoZXogUHJhZGEgIDxtYXJpby5wcmFkYUBzYW1z dW5nLmNvbT4KCiAgICAgICAgW0VGTF0gUkVHUkVTU0lPTiBhZnRlciByMTUzNDMyOiBzb21lIGFj Y2Vzc2liaWxpdHkgdGVzdHMgY3Jhc2guCiAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcv c2hvd19idWcuY2dpP2lkPTExOTMzMwoKICAgICAgICBSZXZpZXdlZCBieSBOT0JPRFkgKE9PUFMh KS4KCiAgICAgICAgQWRkIG1pc3NpbmcgbnVsbC1jaGVjayB0byBhdm9pZCBkZXJlZmVyZW5jaW5n IGEgbm9uLWV4aXN0ZW50IHBhcmVudC4KCiAgICAgICAgKiBXZWJLaXRUZXN0UnVubmVyL0luamVj dGVkQnVuZGxlL2F0ay9BY2Nlc3NpYmlsaXR5VUlFbGVtZW50QXRrLmNwcDoKICAgICAgICAoV1RS OjphdHRyaWJ1dGVzT2ZFbGVtZW50KTogRGl0dG8uCi0tLQogVG9vbHMvQ2hhbmdlTG9nICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB8ICAgMTIgKysrKysrKysrKysr CiAuLi4vSW5qZWN0ZWRCdW5kbGUvYXRrL0FjY2Vzc2liaWxpdHlVSUVsZW1lbnRBdGsuY3BwICAg ICAgIHwgICAgMyArKy0KIDIgZmlsZXMgY2hhbmdlZCwgMTQgaW5zZXJ0aW9ucygrKSwgMSBkZWxl dGlvbigtKQoKZGlmZiAtLWdpdCBhL1Rvb2xzL0NoYW5nZUxvZyBiL1Rvb2xzL0NoYW5nZUxvZwpp bmRleCBhNWI3Zjg2Li5jYzgxMTNiIDEwMDY0NAotLS0gYS9Ub29scy9DaGFuZ2VMb2cKKysrIGIv VG9vbHMvQ2hhbmdlTG9nCkBAIC0xLDMgKzEsMTUgQEAKKzIwMTMtMDctMzEgIE1hcmlvIFNhbmNo ZXogUHJhZGEgIDxtYXJpby5wcmFkYUBzYW1zdW5nLmNvbT4KKworICAgICAgICBbRUZMXSBSRUdS RVNTSU9OIGFmdGVyIHIxNTM0MzI6IHNvbWUgYWNjZXNzaWJpbGl0eSB0ZXN0cyBjcmFzaC4KKyAg ICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTExOTMzMworCisg ICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgIEFkZCBtaXNzaW5n IG51bGwtY2hlY2sgdG8gYXZvaWQgZGVyZWZlcmVuY2luZyBhIG5vbi1leGlzdGVudCBwYXJlbnQu CisKKyAgICAgICAgKiBXZWJLaXRUZXN0UnVubmVyL0luamVjdGVkQnVuZGxlL2F0ay9BY2Nlc3Np YmlsaXR5VUlFbGVtZW50QXRrLmNwcDoKKyAgICAgICAgKFdUUjo6YXR0cmlidXRlc09mRWxlbWVu dCk6IERpdHRvLgorCiAyMDEzLTA3LTI5ICBNYXJpbyBTYW5jaGV6IFByYWRhICA8bWFyaW8ucHJh ZGFAc2Ftc3VuZy5jb20+CiAKICAgICAgICAgW0FUS10gSW1wbGVtZW50IGF0dHJpYnV0ZXNPZkNo aWxkcmVuKCkgZm9yIEFjY2Vzc2liaWxpdHlVSUVsZW1lbnQKZGlmZiAtLWdpdCBhL1Rvb2xzL1dl YktpdFRlc3RSdW5uZXIvSW5qZWN0ZWRCdW5kbGUvYXRrL0FjY2Vzc2liaWxpdHlVSUVsZW1lbnRB dGsuY3BwIGIvVG9vbHMvV2ViS2l0VGVzdFJ1bm5lci9JbmplY3RlZEJ1bmRsZS9hdGsvQWNjZXNz aWJpbGl0eVVJRWxlbWVudEF0ay5jcHAKaW5kZXggNzUxNGE0ZS4uNThmOTMxMyAxMDA2NDQKLS0t IGEvVG9vbHMvV2ViS2l0VGVzdFJ1bm5lci9JbmplY3RlZEJ1bmRsZS9hdGsvQWNjZXNzaWJpbGl0 eVVJRWxlbWVudEF0ay5jcHAKKysrIGIvVG9vbHMvV2ViS2l0VGVzdFJ1bm5lci9JbmplY3RlZEJ1 bmRsZS9hdGsvQWNjZXNzaWJpbGl0eVVJRWxlbWVudEF0ay5jcHAKQEAgLTI5Miw3ICsyOTIsOCBA QCBzdGF0aWMgU3RyaW5nIGF0dHJpYnV0ZXNPZkVsZW1lbnQoQWNjZXNzaWJpbGl0eVVJRWxlbWVu dCogZWxlbWVudCkKICAgICAvLyBGb3IgdGhlIHBhcmVudCB3ZSBwcmludCBpdHMgcm9sZSBhbmQg aXRzIG5hbWUsIGlmIGF2YWlsYWJsZS4KICAgICBidWlsZGVyLmFwcGVuZCgiQVhQYXJlbnQ6ICIp OwogICAgIEFjY2Vzc2liaWxpdHlVSUVsZW1lbnQqIHBhcmVudCA9IGVsZW1lbnQtPnBhcmVudEVs ZW1lbnQoKS5nZXQoKTsKLSAgICBpZiAoQXRrT2JqZWN0KiBhdGtQYXJlbnQgPSBwYXJlbnQtPnBs YXRmb3JtVUlFbGVtZW50KCkuZ2V0KCkpIHsKKyAgICBBdGtPYmplY3QqIGF0a1BhcmVudCA9IHBh cmVudCA/IHBhcmVudC0+cGxhdGZvcm1VSUVsZW1lbnQoKS5nZXQoKSA6IDA7CisgICAgaWYgKGF0 a1BhcmVudCkgewogICAgICAgICBidWlsZGVyLmFwcGVuZChyb2xlVG9TdHJpbmcoYXRrX29iamVj dF9nZXRfcm9sZShhdGtQYXJlbnQpKSk7CiAgICAgICAgIGNvbnN0IGNoYXIqIHBhcmVudE5hbWUg PSBhdGtfb2JqZWN0X2dldF9uYW1lKGF0a1BhcmVudCk7CiAgICAgICAgIGlmIChwYXJlbnROYW1l ICYmIGdfdXRmOF9zdHJsZW4ocGFyZW50TmFtZSwgLTEpKQotLSAKMS43LjEwLjQKCg== 208297 2013-08-07 13:42:33 -0700 2013-08-07 14:12:31 -0700 Patch proposal bug-119333-20130807224231.patch text/plain 1839 mario U3VidmVyc2lvbiBSZXZpc2lvbjogMTUzNzQyCmRpZmYgLS1naXQgYS9Ub29scy9DaGFuZ2VMb2cg Yi9Ub29scy9DaGFuZ2VMb2cKaW5kZXggYWVmNGExOTQ4MTdjNGYyYjlkNDU2OTA4NDE2MWI4MWMx Y2Q0NjUzNS4uNjk1YjhiNDRkZmViODRhNWJjMzY5Y2Y5NjFjODViM2ExMTM5MjZmYSAxMDA2NDQK LS0tIGEvVG9vbHMvQ2hhbmdlTG9nCisrKyBiL1Rvb2xzL0NoYW5nZUxvZwpAQCAtMSwzICsxLDE3 IEBACisyMDEzLTA4LTA3ICBNYXJpbyBTYW5jaGV6IFByYWRhICA8bWFyaW8ucHJhZGFAc2Ftc3Vu Zy5jb20+CisKKyAgICAgICAgW0VGTF0gUkVHUkVTU0lPTiBhZnRlciByMTUzNDMyOiBzb21lIGFj Y2Vzc2liaWxpdHkgdGVzdHMgY3Jhc2guCisgICAgICAgIGh0dHBzOi8vYnVncy53ZWJraXQub3Jn L3Nob3dfYnVnLmNnaT9pZD0xMTkzMzMKKworICAgICAgICBSZXZpZXdlZCBieSBOT0JPRFkgKE9P UFMhKS4KKworICAgICAgICBVc2UgYSBSZWZQdHIgdG8gc3RvcmUgYSByZWZlcmVuY2UgdG8gdGhl IHBhcmVudCBlbGVtZW50IG9mCisgICAgICAgIGFuIEFjY2Vzc2liaWxpdHlVSUVsZW1lbnQgaW5z dGVhZCBvZiB0aGUgcmF3IHBvaW50ZXIsIHNvIHdlCisgICAgICAgIG5ldmVyIGRlcmVmZW5jZSBh IGZ1bmN0aW9uIGZyb20gYW4gaW52YWxpZCBwb2ludGVyLgorCisgICAgICAgICogV2ViS2l0VGVz dFJ1bm5lci9JbmplY3RlZEJ1bmRsZS9hdGsvQWNjZXNzaWJpbGl0eVVJRWxlbWVudEF0ay5jcHA6 CisgICAgICAgIChXVFI6OmF0dHJpYnV0ZXNPZkVsZW1lbnQpOiBVc2UgYSBSZWZQdHIgaW5zdGVh ZCBvZiBhIHJhdyBwb2ludGVyLgorCiAyMDEzLTA4LTA1ICBCcmlhbiBIb2x0ICA8YnJpYW4uaG9s dEBzYW1zdW5nLmNvbT4KIAogICAgICAgICBbR1RLXSBJbXBsZW1lbnQgbGVhayBjaGVja2luZyB3 aXRoIHZhbGdyaW5kCmRpZmYgLS1naXQgYS9Ub29scy9XZWJLaXRUZXN0UnVubmVyL0luamVjdGVk QnVuZGxlL2F0ay9BY2Nlc3NpYmlsaXR5VUlFbGVtZW50QXRrLmNwcCBiL1Rvb2xzL1dlYktpdFRl c3RSdW5uZXIvSW5qZWN0ZWRCdW5kbGUvYXRrL0FjY2Vzc2liaWxpdHlVSUVsZW1lbnRBdGsuY3Bw CmluZGV4IDU4ZjkzMTM1N2U4OWQzMWE2ZGE4OWQyZGQyNTNhNmRmOGJiMDhhYjguLmE0NGFkNDYz ZWFjNTQ3Y2RkZTcxYjg1OTMzNzc4ODE2NjIxMzA4ZmIgMTAwNjQ0Ci0tLSBhL1Rvb2xzL1dlYktp dFRlc3RSdW5uZXIvSW5qZWN0ZWRCdW5kbGUvYXRrL0FjY2Vzc2liaWxpdHlVSUVsZW1lbnRBdGsu Y3BwCisrKyBiL1Rvb2xzL1dlYktpdFRlc3RSdW5uZXIvSW5qZWN0ZWRCdW5kbGUvYXRrL0FjY2Vz c2liaWxpdHlVSUVsZW1lbnRBdGsuY3BwCkBAIC0yOTEsNyArMjkxLDcgQEAgc3RhdGljIFN0cmlu ZyBhdHRyaWJ1dGVzT2ZFbGVtZW50KEFjY2Vzc2liaWxpdHlVSUVsZW1lbnQqIGVsZW1lbnQpCiAK ICAgICAvLyBGb3IgdGhlIHBhcmVudCB3ZSBwcmludCBpdHMgcm9sZSBhbmQgaXRzIG5hbWUsIGlm IGF2YWlsYWJsZS4KICAgICBidWlsZGVyLmFwcGVuZCgiQVhQYXJlbnQ6ICIpOwotICAgIEFjY2Vz c2liaWxpdHlVSUVsZW1lbnQqIHBhcmVudCA9IGVsZW1lbnQtPnBhcmVudEVsZW1lbnQoKS5nZXQo KTsKKyAgICBSZWZQdHI8QWNjZXNzaWJpbGl0eVVJRWxlbWVudD4gcGFyZW50ID0gZWxlbWVudC0+ cGFyZW50RWxlbWVudCgpOwogICAgIEF0a09iamVjdCogYXRrUGFyZW50ID0gcGFyZW50ID8gcGFy ZW50LT5wbGF0Zm9ybVVJRWxlbWVudCgpLmdldCgpIDogMDsKICAgICBpZiAoYXRrUGFyZW50KSB7 CiAgICAgICAgIGJ1aWxkZXIuYXBwZW5kKHJvbGVUb1N0cmluZyhhdGtfb2JqZWN0X2dldF9yb2xl KGF0a1BhcmVudCkpKTsK