125042 2013-11-30 23:11:13 -0800 AX: Crash at WebCore::commonTreeScope 2013-12-02 06:16:26 -0800 1 1 1 Unclassified WebKit Accessibility 528+ (Nightly build) All All RESOLVED FIXED InRadar P2 Normal --- 1 cfleizach cfleizach aboxhall apinheiro commit-queue dmazzoni esprehn+autocc jcraig jdiggs kangil.han mario samuel_white webkit-bug-importer oldest_to_newest 955136 0 cfleizach 2013-11-30 23:11:13 -0800 It's possible to crash at * thread #1: tid = 0x1fd7d3, 0x0000000108e0101a JavaScriptCore`WTFCrash + 42 at Assertions.cpp:341, queue = 'com.apple.main-thread, stop reason = EXC_BAD_ACCESS (code=1, address=0xbbadbeef) frame #0: 0x0000000108e0101a JavaScriptCore`WTFCrash + 42 at Assertions.cpp:341 frame #1: 0x0000000109c74999 WebCore`WTF::CrashOnOverflow::overflowed() + 9 at CheckedArithmetic.h:80 frame #2: 0x000000010b7595ff WebCore`WTF::Vector<WebCore::TreeScope*, 5ul, WTF::CrashOnOverflow>::at(this=0x00007fff5ca13a10, i=1) + 79 at Vector.h:584 frame #3: 0x000000010b75956d WebCore`WTF::Vector<WebCore::TreeScope*, 5ul, WTF::CrashOnOverflow>::operator[](this=0x00007fff5ca13a10, i=1) + 29 at Vector.h:604 frame #4: 0x000000010b758983 WebCore`WebCore::commonTreeScope(nodeA=0x00007f8168ed9c30, nodeB=0x00007f816ba594f0) + 419 at TreeScope.cpp:428 frame #5: 0x000000010a5b6d45 WebCore`WebCore::comparePositions(a=0x00007fff5ca13d00, b=0x00007fff5ca13d10) + 53 at htmlediting.cpp:71 frame #6: 0x000000010b773c10 WebCore`WebCore::VisibleSelection::setBaseAndExtentToDeepEquivalents(this=0x00007fff5ca13d00) + 560 at VisibleSelection.cpp:268 frame #7: 0x000000010b77286c WebCore`WebCore::VisibleSelection::validate(this=0x00007fff5ca13d00, granularity=CharacterGranularity) + 28 at VisibleSelection.cpp:413 frame #8: 0x000000010b772c24 WebCore`WebCore::VisibleSelection::VisibleSelection(this=0x00007fff5ca13d00, base=0x00007fff5ca15068, extent=0x00007fff5ca15050, isDirectional=false) + 164 at VisibleSelection.cpp:83 frame #9: 0x000000010b772b74 WebCore`WebCore::VisibleSelection::VisibleSelection(this=0x00007fff5ca13d00, base=0x00007fff5ca15068, extent=0x00007fff5ca15050, isDirectional=false) + 52 at VisibleSelection.cpp:84 frame #10: 0x0000000109c45e85 WebCore`WebCore::AccessibilityObject::visiblePositionRangeForUnorderedPositions(this=0x00007f816bc015b0, visiblePos1=0x00007fff5ca15068, visiblePos2=0x00007fff5ca15050) const + 197 at AccessibilityObject.cpp:662 frame #11: 0x000000010b797278 WebCore`-[WebAccessibilityObjectWrapper accessibilityAttributeValue:forParameter:](self=0x00007f8168a5aed0, _cmd=0x00007fff8cb8a788, attribute=0x00007f816af52a80, parameter=0x00007f816c804030) + 11192 at WebAccessibilityObjectWrapperMac.mm:3389 when text markers from detached frames are used that do not have common tree scopes. 955137 1 cfleizach 2013-11-30 23:11:25 -0800 <rdar://problem/14275055> 955139 2 218109 cfleizach 2013-11-30 23:40:42 -0800 Created attachment 218109 patch 955359 3 218109 commit-queue 2013-12-02 06:16:24 -0800 Comment on attachment 218109 patch Clearing flags on attachment: 218109 Committed r159932: <http://trac.webkit.org/changeset/159932> 955360 4 commit-queue 2013-12-02 06:16:26 -0800 All reviewed patches have been landed. Closing bug. 218109 2013-11-30 23:40:42 -0800 2013-12-02 06:16:24 -0800 patch patch text/plain 5725 cfleizach SW5kZXg6IFNvdXJjZS9XZWJDb3JlL0NoYW5nZUxvZwo9PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBTb3VyY2UvV2Vi Q29yZS9DaGFuZ2VMb2cJKHJldmlzaW9uIDE1OTg5NykKKysrIFNvdXJjZS9XZWJDb3JlL0NoYW5n ZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDIwIEBACisyMDEzLTExLTMwICBDaHJpcyBG bGVpemFjaCAgPGNmbGVpemFjaEBhcHBsZS5jb20+CisKKyAgICAgICAgQVg6IENyYXNoIGF0IFdl YkNvcmU6OmNvbW1vblRyZWVTY29wZQorICAgICAgICBodHRwczovL2J1Z3Mud2Via2l0Lm9yZy9z aG93X2J1Zy5jZ2k/aWQ9MTI1MDQyCisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BT ISkuCisKKyAgICAgICAgV2hlbiBhbiBBWCB0ZXh0IG1hcmtlciB0aGF0IHJlZmVyZW5jZXMgYSBu b2RlIGluIGEgZGV0YWNoZWQgZG9jdW1lbnQgaXMgdXNlZCB0byBjcmVhdGUgYSB0ZXh0IG1hcmtl ciByYW5nZSwgYSBjcmFzaCBvY2N1cnMKKyAgICAgICAgYmVjYXVzZSB0aGUgbWV0aG9kIHRvIGRl dGVybWluZSBjb21tb25UcmVlU2NvcGVzIGRvZXMgbm90IGFjY291bnQgZm9yIHdoZW4gdGhlcmUg YXJlIG5vIGNvbW1vbiB0cmVlIHNjb3Blcy4KKworICAgICAgICBUZXN0OiBwbGF0Zm9ybS9tYWMv YWNjZXNzaWJpbGl0eS9vcmRlcmVkLXRleHRtYXJrZXItY3Jhc2guaHRtbAorCisgICAgICAgICog YWNjZXNzaWJpbGl0eS9BY2Nlc3NpYmlsaXR5T2JqZWN0LmNwcDoKKyAgICAgICAgKFdlYkNvcmU6 OkFjY2Vzc2liaWxpdHlPYmplY3Q6OnZpc2libGVQb3NpdGlvblJhbmdlRm9yVW5vcmRlcmVkUG9z aXRpb25zKToKKyAgICAgICAgKiBkb20vVHJlZVNjb3BlLmNwcDoKKyAgICAgICAgKFdlYkNvcmU6 OmNvbW1vblRyZWVTY29wZSk6CisKIDIwMTMtMTEtMzAgIFJ5dWFuIENob2kgIDxyeXVhbi5jaG9p QHNhbXN1bmcuY29tPgogCiAgICAgICAgIFtFRkxdIEltcGxlbWVudCBzY3JvbGxiYXJUaGlja25l c3MgZm9yIG9wYXF1ZSBzY3JvbGxiYXIKSW5kZXg6IFNvdXJjZS9XZWJDb3JlL2FjY2Vzc2liaWxp dHkvQWNjZXNzaWJpbGl0eU9iamVjdC5jcHAKPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291cmNlL1dlYkNvcmUv YWNjZXNzaWJpbGl0eS9BY2Nlc3NpYmlsaXR5T2JqZWN0LmNwcAkocmV2aXNpb24gMTU5ODkxKQor KysgU291cmNlL1dlYkNvcmUvYWNjZXNzaWJpbGl0eS9BY2Nlc3NpYmlsaXR5T2JqZWN0LmNwcAko d29ya2luZyBjb3B5KQpAQCAtNjQ5LDYgKzY0OSwxMCBAQAogICAgIGlmICh2aXNpYmxlUG9zMS5p c051bGwoKSB8fCB2aXNpYmxlUG9zMi5pc051bGwoKSkKICAgICAgICAgcmV0dXJuIFZpc2libGVQ b3NpdGlvblJhbmdlKCk7CiAKKyAgICAvLyBJZiB0aGVyZSdzIG5vIGNvbW1vbiB0cmVlIHNjb3Bl IGJldHdlZW4gcG9zaXRpb25zLCByZXR1cm4gZWFybHkuCisgICAgaWYgKCFjb21tb25UcmVlU2Nv cGUodmlzaWJsZVBvczEuZGVlcEVxdWl2YWxlbnQoKS5kZXByZWNhdGVkTm9kZSgpLCB2aXNpYmxl UG9zMi5kZWVwRXF1aXZhbGVudCgpLmRlcHJlY2F0ZWROb2RlKCkpKQorICAgICAgICByZXR1cm4g VmlzaWJsZVBvc2l0aW9uUmFuZ2UoKTsKKyAgICAKICAgICBWaXNpYmxlUG9zaXRpb24gc3RhcnRQ b3M7CiAgICAgVmlzaWJsZVBvc2l0aW9uIGVuZFBvczsKICAgICBib29sIGFscmVhZHlJbk9yZGVy OwpJbmRleDogU291cmNlL1dlYkNvcmUvZG9tL1RyZWVTY29wZS5jcHAKPT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0g U291cmNlL1dlYkNvcmUvZG9tL1RyZWVTY29wZS5jcHAJKHJldmlzaW9uIDE1OTg5MSkKKysrIFNv dXJjZS9XZWJDb3JlL2RvbS9UcmVlU2NvcGUuY3BwCSh3b3JraW5nIGNvcHkpCkBAIC00MjUsNiAr NDI1LDEwIEBACiAKICAgICBmb3IgKDsgaW5kZXhBID4gMCAmJiBpbmRleEIgPiAwICYmIHRyZWVT Y29wZXNBW2luZGV4QSAtIDFdID09IHRyZWVTY29wZXNCW2luZGV4QiAtIDFdOyAtLWluZGV4QSwg LS1pbmRleEIpIHsgfQogCisgICAgLy8gSWYgdGhlIG5vZGVzIGhhZCBubyBjb21tb24gdHJlZSBz Y29wZSwgcmV0dXJuIGltbWVkaWF0ZWx5LgorICAgIGlmIChpbmRleEEgPT0gdHJlZVNjb3Blc0Eu c2l6ZSgpKQorICAgICAgICByZXR1cm4gbnVsbHB0cjsKKyAgICAKICAgICByZXR1cm4gdHJlZVNj b3Blc0FbaW5kZXhBXSA9PSB0cmVlU2NvcGVzQltpbmRleEJdID8gdHJlZVNjb3Blc0FbaW5kZXhB XSA6IG51bGxwdHI7CiB9CiAKSW5kZXg6IExheW91dFRlc3RzL0NoYW5nZUxvZwo9PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 Ci0tLSBMYXlvdXRUZXN0cy9DaGFuZ2VMb2cJKHJldmlzaW9uIDE1OTg5NykKKysrIExheW91dFRl c3RzL0NoYW5nZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDEzIEBACisyMDEzLTExLTMw ICBDaHJpcyBGbGVpemFjaCAgPGNmbGVpemFjaEBhcHBsZS5jb20+CisKKyAgICAgICAgQVg6IENy YXNoIGF0IFdlYkNvcmU6OmNvbW1vblRyZWVTY29wZQorICAgICAgICBodHRwczovL2J1Z3Mud2Vi a2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9MTI1MDQyCisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9C T0RZIChPT1BTISkuCisKKyAgICAgICAgKiBwbGF0Zm9ybS9tYWMvYWNjZXNzaWJpbGl0eS9vcmRl cmVkLXRleHRtYXJrZXItY3Jhc2gtZXhwZWN0ZWQudHh0OiBBZGRlZC4KKyAgICAgICAgKiBwbGF0 Zm9ybS9tYWMvYWNjZXNzaWJpbGl0eS9vcmRlcmVkLXRleHRtYXJrZXItY3Jhc2guaHRtbDogQWRk ZWQuCisKIDIwMTMtMTEtMjkgIE1pY2hhxYIgUGFrdcWCYSB2ZWwgUnV0a2EgIDxtLnBha3VsYUBz YW1zdW5nLmNvbT4KIAogICAgICAgICBVbnJldmlld2VkIEVGTCBnYXJkZW5pbmcKSW5kZXg6IExh eW91dFRlc3RzL3BsYXRmb3JtL21hYy9hY2Nlc3NpYmlsaXR5L29yZGVyZWQtdGV4dG1hcmtlci1j cmFzaC1leHBlY3RlZC50eHQKPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gTGF5b3V0VGVzdHMvcGxhdGZvcm0vbWFj L2FjY2Vzc2liaWxpdHkvb3JkZXJlZC10ZXh0bWFya2VyLWNyYXNoLWV4cGVjdGVkLnR4dAkocmV2 aXNpb24gMCkKKysrIExheW91dFRlc3RzL3BsYXRmb3JtL21hYy9hY2Nlc3NpYmlsaXR5L29yZGVy ZWQtdGV4dG1hcmtlci1jcmFzaC1leHBlY3RlZC50eHQJKHdvcmtpbmcgY29weSkKQEAgLTAsMCAr MSw3IEBACisKK1RoaXMgdGVzdHMgdGhhdCBjb21wYXJpbmcgdGV4dCBtYXJrZXJzIHRoYXQgaGF2 ZSBubyBjb21tb24gdHJlZSBzY29wZSB3b24ndCBjcmFzaAorCitPbiBzdWNjZXNzLCB5b3Ugd2ls bCBzZWUgYSBzZXJpZXMgb2YgIlBBU1MiIG1lc3NhZ2VzLCBmb2xsb3dlZCBieSAiVEVTVCBDT01Q TEVURSIuCisKKworCkluZGV4OiBMYXlvdXRUZXN0cy9wbGF0Zm9ybS9tYWMvYWNjZXNzaWJpbGl0 eS9vcmRlcmVkLXRleHRtYXJrZXItY3Jhc2guaHRtbAo9PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBMYXlvdXRUZXN0 cy9wbGF0Zm9ybS9tYWMvYWNjZXNzaWJpbGl0eS9vcmRlcmVkLXRleHRtYXJrZXItY3Jhc2guaHRt bAkocmV2aXNpb24gMCkKKysrIExheW91dFRlc3RzL3BsYXRmb3JtL21hYy9hY2Nlc3NpYmlsaXR5 L29yZGVyZWQtdGV4dG1hcmtlci1jcmFzaC5odG1sCSh3b3JraW5nIGNvcHkpCkBAIC0wLDAgKzEs NTAgQEAKKzwhRE9DVFlQRSBIVE1MIFBVQkxJQyAiLS8vSUVURi8vRFREIEhUTUwvL0VOIj4KKzxo dG1sPgorPGhlYWQ+Cis8c2NyaXB0IHNyYz0iLi4vLi4vLi4vcmVzb3VyY2VzL2pzLXRlc3QtcHJl LmpzIj48L3NjcmlwdD4KKzwvaGVhZD4KKzxib2R5IGlkPSJib2R5IiBvbmxvYWQ9InNldFRpbWVv dXQoJ3J1blRlc3QoKTsnLCAxKSI+CisKKzxkaXYgaWQ9ImNvbnRlbnQxIj4KKzxpZnJhbWUgc3Jj PSJkYXRhOnRleHQvaHRtbCw8Ym9keT48ZGl2PmhlbGxvPC9kaXY+Ij48L2lmcmFtZT4KKzwvZGl2 PgorCis8ZGl2IHJvbGU9Imdyb3VwIiBpZD0iY29uc29sZSI+PC9kaXY+CisKKzxzY3JpcHQ+CisK KyAgICBkZXNjcmlwdGlvbigiVGhpcyB0ZXN0cyB0aGF0IGNvbXBhcmluZyB0ZXh0IG1hcmtlcnMg dGhhdCBoYXZlIG5vIGNvbW1vbiB0cmVlIHNjb3BlIHdvbid0IGNyYXNoIik7CisKKyAgICBpZiAo d2luZG93LmFjY2Vzc2liaWxpdHlDb250cm9sbGVyICYmIHdpbmRvdy50ZXN0UnVubmVyKSB7Cisg ICAgICAgIHdpbmRvdy50ZXN0UnVubmVyLndhaXRVbnRpbERvbmUoKTsKKyAgICAgICAgd2luZG93 LmpzVGVzdElzQXN5bmMgPSB0cnVlOworICAgIH0KKworICAgIGZ1bmN0aW9uIHJ1blRlc3QoKSB7 CisKKyAgICAgICAgLy8gR2V0IGEgdGV4dCBtYXJrZXIgaW5zaWRlIHRoZSBmcmFtZSB3ZSB3aWxs IHJlbW92ZS4KKyAgICAgICAgdmFyIHRleHQxID0gYWNjZXNzaWJpbGl0eUNvbnRyb2xsZXIuYWNj ZXNzaWJsZUVsZW1lbnRCeUlkKCJjb250ZW50MSIpLmNoaWxkQXRJbmRleCgwKS5jaGlsZEF0SW5k ZXgoMCkuY2hpbGRBdEluZGV4KDApLmNoaWxkQXRJbmRleCgwKTsKKyAgICAgICAgdmFyIHJhbmdl MSA9IHRleHQxLnRleHRNYXJrZXJSYW5nZUZvckVsZW1lbnQodGV4dDEpOworICAgICAgICBtYXJr ZXIxID0gdGV4dDEuc3RhcnRUZXh0TWFya2VyRm9yVGV4dE1hcmtlclJhbmdlKHJhbmdlMSk7CisK KyAgICAgICAgLy8gR2V0IGEgbWFya2VyIGZvciB0aGUgbWFpbiBmcmFtZS4KKyAgICAgICAgdmFy IHRleHQyID0gYWNjZXNzaWJpbGl0eUNvbnRyb2xsZXIucm9vdEVsZW1lbnQuY2hpbGRBdEluZGV4 KDApLmNoaWxkQXRJbmRleCgwKTsKKyAgICAgICAgdmFyIHJhbmdlMiA9IHRleHQyLnRleHRNYXJr ZXJSYW5nZUZvckVsZW1lbnQodGV4dDIpOworICAgICAgICBtYXJrZXIyID0gdGV4dDIuc3RhcnRU ZXh0TWFya2VyRm9yVGV4dE1hcmtlclJhbmdlKHJhbmdlMik7CisKKyAgICAgICAgLy8gUmVtb3Zl IHRoZSBjaGlsZCBmcmFtZSB0aGF0IHdlIGhhdmUgYSByZWZlcmVuY2UgdG8gdGhlIHRleHQgbWFy a2VyIGZyb20uCisgICAgICAgIHZhciBjb250ZW50MSA9IGRvY3VtZW50LmdldEVsZW1lbnRCeUlk KCJjb250ZW50MSIpLmNoaWxkTm9kZXNbMF07CisgICAgICAgIGNvbnRlbnQxLnBhcmVudE5vZGUu cmVtb3ZlQ2hpbGQoY29udGVudDEpOworCisgICAgICAgIC8vIEFzayBmb3IgdGhlIHRleHQgbWFy a2VyIHJhbmdlIHdpdGggdGhlIG1hcmtlcnMgaW4gYSBkaWZmZXJlbnQgdHJlZS4KKyAgICAgICAg Ly8gVGhpcyBzaG91bGQgTk9UIGNyYXNoIQorICAgICAgICB2YXIgcmFuZ2UgPSBhY2Nlc3NpYmls aXR5Q29udHJvbGxlci5yb290RWxlbWVudC5jaGlsZEF0SW5kZXgoMCkudGV4dE1hcmtlclJhbmdl Rm9yTWFya2VycyhtYXJrZXIxLCBtYXJrZXIyKTsKKyAgICAgICAgd2luZG93LnRlc3RSdW5uZXIu bm90aWZ5RG9uZSgpOworICAgICAgICBmaW5pc2hKU1Rlc3QoKTsKKyAgICB9CisKKzwvc2NyaXB0 PgorCis8c2NyaXB0IHNyYz0iLi4vLi4vLi4vcmVzb3VyY2VzL2pzLXRlc3QtcG9zdC5qcyI+PC9z Y3JpcHQ+Cis8L2JvZHk+Cis8L2h0bWw+Cg==