137289 2014-09-30 23:07:32 -0700 AX: iOS8: Crash at -[WebAccessibilityObjectWrapper accessibilityElementAtIndex:] 2014-10-06 18:10:29 -0700 1 1 1 Unclassified WebKit Accessibility 528+ (Nightly build) All All RESOLVED FIXED InRadar P2 Normal --- 1 cfleizach cfleizach aboxhall apinheiro commit-queue dbates dmazzoni jcraig jdiggs mario samuel_white webkit-bug-importer oldest_to_newest 1038479 0 cfleizach 2014-09-30 23:07:32 -0700 Exception Type: EXC_BAD_ACCESS (SIGSEGV) Exception Subtype: KERN_INVALID_ADDRESS at 0x00000000bbadbeef Triggered by Thread: 0 Thread 0 name: Dispatch queue: com.apple.main-thread Thread 0 Crashed: 0 JavaScriptCore 0x00000001855849f4 WTFCrash + 72 1 JavaScriptCore 0x00000001855849e8 WTFCrash + 60 2 WebCore 0x0000000191ab4ba8 WTF::CrashOnOverflow::overflowed() + 8 (CheckedArithmetic.h:77) 3 WebCore 0x00000001925a9008 -[WebAccessibilityObjectWrapper accessibilityElementAtIndex:] + 244 (Vector.h:624) 4 WebProcess 0x00000001821d58a8 -[WKAccessibilityWebPageObjectAccessibility _accessibilityElementsWithCount:originalElement:next:] + 376 <rdar://problem/18436805> 1038480 1 239006 cfleizach 2014-09-30 23:11:10 -0700 Created attachment 239006 patch 1039611 2 239006 commit-queue 2014-10-05 16:10:05 -0700 Comment on attachment 239006 patch Clearing flags on attachment: 239006 Committed r174330: <http://trac.webkit.org/changeset/174330> 1039612 3 commit-queue 2014-10-05 16:10:08 -0700 All reviewed patches have been landed. Closing bug. 1039873 4 239006 dbates 2014-10-06 16:44:13 -0700 Comment on attachment 239006 patch View in context: https://bugs.webkit.org/attachment.cgi?id=239006&action=review > Tools/DumpRenderTree/ios/AccessibilityUIElementIOS.mm:194 > + for (NSInteger k = location; k < (location+length); ++k) This broke the iOS build. The comparison here led to the clang warning, "comparison of integers of different signs", because the result of the sub expression location + length is a unsigned data type, but k is a signed data type. And we treat warnings as errors. 1039874 5 239006 cfleizach 2014-10-06 16:45:50 -0700 Comment on attachment 239006 patch View in context: https://bugs.webkit.org/attachment.cgi?id=239006&action=review >> Tools/DumpRenderTree/ios/AccessibilityUIElementIOS.mm:194 >> + for (NSInteger k = location; k < (location+length); ++k) > > This broke the iOS build. The comparison here led to the clang warning, "comparison of integers of different signs", because the result of the sub expression location + length is a unsigned data type, but k is a signed data type. And we treat warnings as errors. strange because I tested on iOS simulator to create this unit test. i'll take another look 1039897 6 dbates 2014-10-06 17:43:54 -0700 (In reply to comment #5) > (From update of attachment 239006 [details]) > View in context: https://bugs.webkit.org/attachment.cgi?id=239006&action=review > > >> Tools/DumpRenderTree/ios/AccessibilityUIElementIOS.mm:194 > >> + for (NSInteger k = location; k < (location+length); ++k) > > > > This broke the iOS build. The comparison here led to the clang warning, "comparison of integers of different signs", because the result of the sub expression location + length is a unsigned data type, but k is a signed data type. And we treat warnings as errors. > > strange because I tested on iOS simulator to create this unit test. i'll take another look Have you had a chance to take another look? I'm unclear how we are using unsigned, size_t, and NSInteger data types in this code. It seems like we to expect to convert from unsigned to signed to unsigned data types? (why?) Unless you advise otherwise, I plan to roll out <http://trac.webkit.org/changeset/174330> in 10 minutes from now (5:53 PM PST). 1039902 7 cfleizach 2014-10-06 17:48:56 -0700 (In reply to comment #6) > (In reply to comment #5) > > (From update of attachment 239006 [details] [details]) > > View in context: https://bugs.webkit.org/attachment.cgi?id=239006&action=review > > > > >> Tools/DumpRenderTree/ios/AccessibilityUIElementIOS.mm:194 > > >> + for (NSInteger k = location; k < (location+length); ++k) > > > > > > This broke the iOS build. The comparison here led to the clang warning, "comparison of integers of different signs", because the result of the sub expression location + length is a unsigned data type, but k is a signed data type. And we treat warnings as errors. > > > > strange because I tested on iOS simulator to create this unit test. i'll take another look > > Have you had a chance to take another look? Yes, it takes forever to build after an update. I'm still building > I'm unclear how we are using unsigned, size_t, and NSInteger data types in this code. It seems like we to expect to convert from unsigned to signed to unsigned data types? (why?) I'm cleaning it up > Unless you advise otherwise, I plan to roll out <http://trac.webkit.org/changeset/174330> in 10 minutes from now (5:53 PM PST). I'd urge you to wait for me to resolve this 1039904 8 dbates 2014-10-06 17:52:02 -0700 (In reply to comment #7) > [...] > I'd urge you to wait for me to resolve this Will wait. When do you envision landing a fix for this issue? In the next 30 minutes? hour? 1039905 9 cfleizach 2014-10-06 17:53:42 -0700 (In reply to comment #8) > (In reply to comment #7) > > [...] > > I'd urge you to wait for me to resolve this > > Will wait. When do you envision landing a fix for this issue? In the next 30 minutes? hour? 20 mins 1039907 10 cfleizach 2014-10-06 18:10:29 -0700 http://trac.webkit.org/changeset/174376 239006 2014-09-30 23:11:10 -0700 2014-10-06 16:45:50 -0700 patch patch text/plain 5153 cfleizach SW5kZXg6IFNvdXJjZS9XZWJDb3JlL0NoYW5nZUxvZwo9PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBTb3VyY2UvV2Vi Q29yZS9DaGFuZ2VMb2cJKHJldmlzaW9uIDE3NDE0MSkKKysrIFNvdXJjZS9XZWJDb3JlL0NoYW5n ZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDE4IEBACisyMDE0LTA5LTMwICBDaHJpcyBG bGVpemFjaCAgPGNmbGVpemFjaEBhcHBsZS5jb20+CisKKyAgICAgICAgQVg6IGlPUzg6IENyYXNo IGF0IC1bV2ViQWNjZXNzaWJpbGl0eU9iamVjdFdyYXBwZXIgYWNjZXNzaWJpbGl0eUVsZW1lbnRB dEluZGV4Ol0KKyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lk PTEzNzI4OQorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAg IENhc3RpbmcgYSBOU0ludGVnZXIgdG8gYW4gdW5zaWduZWQgY2FuIGJ5cGFzcyB0aGUgY2hlY2sg d2Ugd2VyZSBob3BpbmcgdG8gYWNoaWV2ZSwgCisgICAgICAgIGJlY2F1c2Ugc2l6ZV90IGlzIG5v dCB0aGUgc2FtZSBhcyB1bnNpZ25lZC4KKworICAgICAgICBUZXN0OiBwbGF0Zm9ybS9pb3Mtc2lt L2FjY2Vzc2liaWxpdHkvb3V0LW9mLWJvdW5kcy1jaGlsZC1hY2Nlc3MuaHRtbAorCisgICAgICAg ICogYWNjZXNzaWJpbGl0eS9pb3MvV2ViQWNjZXNzaWJpbGl0eU9iamVjdFdyYXBwZXJJT1MubW06 CisgICAgICAgICgtW1dlYkFjY2Vzc2liaWxpdHlPYmplY3RXcmFwcGVyIGFjY2Vzc2liaWxpdHlF bGVtZW50QXRJbmRleDpdKToKKwogMjAxNC0wOS0zMCAgQ2hyaXMgRHVtZXogIDxjZHVtZXpAYXBw bGUuY29tPgogCiAgICAgICAgIERyb3AgZ2V0UHRyKCkgb3ZlcmxvYWQgdGFraW5nIGEgRG9jdW1l bnQgcmVmZXJlbmNlIGluIGFyZ3VtZW50CkluZGV4OiBTb3VyY2UvV2ViQ29yZS9hY2Nlc3NpYmls aXR5L2lvcy9XZWJBY2Nlc3NpYmlsaXR5T2JqZWN0V3JhcHBlcklPUy5tbQo9PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0t LSBTb3VyY2UvV2ViQ29yZS9hY2Nlc3NpYmlsaXR5L2lvcy9XZWJBY2Nlc3NpYmlsaXR5T2JqZWN0 V3JhcHBlcklPUy5tbQkocmV2aXNpb24gMTc0MDkyKQorKysgU291cmNlL1dlYkNvcmUvYWNjZXNz aWJpbGl0eS9pb3MvV2ViQWNjZXNzaWJpbGl0eU9iamVjdFdyYXBwZXJJT1MubW0JKHdvcmtpbmcg Y29weSkKQEAgLTM3NSwxMSArMzc1LDEyIEBACiAgICAgICAgIHJldHVybiBbW3NlbGYgYXR0YWNo bWVudFZpZXddIGFjY2Vzc2liaWxpdHlFbGVtZW50QXRJbmRleDppbmRleF07CiAgICAgCiAgICAg Y29uc3QgYXV0byYgY2hpbGRyZW4gPSBtX29iamVjdC0+Y2hpbGRyZW4oKTsKLSAgICBpZiAoc3Rh dGljX2Nhc3Q8dW5zaWduZWQ+KGluZGV4KSA+PSBjaGlsZHJlbi5zaXplKCkpCisgICAgc2l6ZV90 IGVsZW1lbnRJbmRleCA9IHN0YXRpY19jYXN0PHNpemVfdD4oaW5kZXgpOworICAgIGlmIChlbGVt ZW50SW5kZXggPj0gY2hpbGRyZW4uc2l6ZSgpKQogICAgICAgICByZXR1cm4gbmlsOwogICAgIAot ICAgIEFjY2Vzc2liaWxpdHlPYmplY3RXcmFwcGVyKiB3cmFwcGVyID0gY2hpbGRyZW5baW5kZXhd LT53cmFwcGVyKCk7Ci0gICAgaWYgKGNoaWxkcmVuW2luZGV4XS0+aXNBdHRhY2htZW50KCkpCisg ICAgQWNjZXNzaWJpbGl0eU9iamVjdFdyYXBwZXIqIHdyYXBwZXIgPSBjaGlsZHJlbltlbGVtZW50 SW5kZXhdLT53cmFwcGVyKCk7CisgICAgaWYgKGNoaWxkcmVuW2VsZW1lbnRJbmRleF0tPmlzQXR0 YWNobWVudCgpKQogICAgICAgICByZXR1cm4gW3dyYXBwZXIgYXR0YWNobWVudFZpZXddOwogCiAg ICAgcmV0dXJuIHdyYXBwZXI7CkluZGV4OiBUb29scy9EdW1wUmVuZGVyVHJlZS9pb3MvQWNjZXNz aWJpbGl0eVVJRWxlbWVudElPUy5tbQo9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBUb29scy9EdW1wUmVuZGVyVHJl ZS9pb3MvQWNjZXNzaWJpbGl0eVVJRWxlbWVudElPUy5tbQkocmV2aXNpb24gMTc0MDkyKQorKysg VG9vbHMvRHVtcFJlbmRlclRyZWUvaW9zL0FjY2Vzc2liaWxpdHlVSUVsZW1lbnRJT1MubW0JKHdv cmtpbmcgY29weSkKQEAgLTE5MSw4ICsxOTEsNyBAQAogCiB2b2lkIEFjY2Vzc2liaWxpdHlVSUVs ZW1lbnQ6OmdldENoaWxkcmVuV2l0aFJhbmdlKFZlY3RvcjxBY2Nlc3NpYmlsaXR5VUlFbGVtZW50 PiYgZWxlbWVudFZlY3RvciwgdW5zaWduZWQgbG9jYXRpb24sIHVuc2lnbmVkIGxlbmd0aCkKIHsK LSAgICBOU1VJbnRlZ2VyIGNoaWxkQ291bnQgPSBbbV9lbGVtZW50IGFjY2Vzc2liaWxpdHlFbGVt ZW50Q291bnRdOwotICAgIGZvciAoTlNVSW50ZWdlciBrID0gbG9jYXRpb247IGsgPCBjaGlsZENv dW50ICYmIGsgPCAobG9jYXRpb24rbGVuZ3RoKTsgKytrKQorICAgIGZvciAoTlNJbnRlZ2VyIGsg PSBsb2NhdGlvbjsgayA8IChsb2NhdGlvbitsZW5ndGgpOyArK2spCiAgICAgICAgIGVsZW1lbnRW ZWN0b3IuYXBwZW5kKEFjY2Vzc2liaWxpdHlVSUVsZW1lbnQoW21fZWxlbWVudCBhY2Nlc3NpYmls aXR5RWxlbWVudEF0SW5kZXg6a10pKTsgICAgCiB9CiAKSW5kZXg6IExheW91dFRlc3RzL0NoYW5n ZUxvZwo9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09Ci0tLSBMYXlvdXRUZXN0cy9DaGFuZ2VMb2cJKHJldmlzaW9uIDE3NDE0 MSkKKysrIExheW91dFRlc3RzL0NoYW5nZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDEz IEBACisyMDE0LTA5LTMwICBDaHJpcyBGbGVpemFjaCAgPGNmbGVpemFjaEBhcHBsZS5jb20+CisK KyAgICAgICAgQVg6IGlPUzg6IENyYXNoIGF0IC1bV2ViQWNjZXNzaWJpbGl0eU9iamVjdFdyYXBw ZXIgYWNjZXNzaWJpbGl0eUVsZW1lbnRBdEluZGV4Ol0KKyAgICAgICAgaHR0cHM6Ly9idWdzLndl YmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTEzNzI4OQorCisgICAgICAgIFJldmlld2VkIGJ5IE5P Qk9EWSAoT09QUyEpLgorCisgICAgICAgICogcGxhdGZvcm0vaW9zLXNpbS9hY2Nlc3NpYmlsaXR5 L291dC1vZi1ib3VuZHMtY2hpbGQtYWNjZXNzLWV4cGVjdGVkLnR4dDogQWRkZWQuCisgICAgICAg ICogcGxhdGZvcm0vaW9zLXNpbS9hY2Nlc3NpYmlsaXR5L291dC1vZi1ib3VuZHMtY2hpbGQtYWNj ZXNzLmh0bWw6IEFkZGVkLgorCiAyMDE0LTA5LTMwICBSb2dlciBGb25nICA8cm9nZXJfZm9uZ0Bh cHBsZS5jb20+CiAKICAgICAgICAgWyBXaW5kb3dzIF0gTW9yZSBXaW5kb3dzIHRlc3QgZ2FyZGVu aW5nIHRvIGdldCBib3RzIGdyZWVuLgpJbmRleDogTGF5b3V0VGVzdHMvcGxhdGZvcm0vaW9zLXNp bS9hY2Nlc3NpYmlsaXR5L291dC1vZi1ib3VuZHMtY2hpbGQtYWNjZXNzLWV4cGVjdGVkLnR4dAo9 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09Ci0tLSBMYXlvdXRUZXN0cy9wbGF0Zm9ybS9pb3Mtc2ltL2FjY2Vzc2liaWxpdHkv b3V0LW9mLWJvdW5kcy1jaGlsZC1hY2Nlc3MtZXhwZWN0ZWQudHh0CShyZXZpc2lvbiAwKQorKysg TGF5b3V0VGVzdHMvcGxhdGZvcm0vaW9zLXNpbS9hY2Nlc3NpYmlsaXR5L291dC1vZi1ib3VuZHMt Y2hpbGQtYWNjZXNzLWV4cGVjdGVkLnR4dAkod29ya2luZyBjb3B5KQpAQCAtMCwwICsxLDEwIEBA Cit0ZXN0CitUaGlzIG1ha2VzIHN1cmUgaWYgb3V0IG9mIGJvdW5kcyByYW5nZXMgY29tZSBpbnRv IGFjY2Vzc2liaWxpdHlFbGVtZW50QXRJbmRleDogdGhlbiB3ZSBkb24ndCBjcmFzaC4KKworT24g c3VjY2VzcywgeW91IHdpbGwgc2VlIGEgc2VyaWVzIG9mICJQQVNTIiBtZXNzYWdlcywgZm9sbG93 ZWQgYnkgIlRFU1QgQ09NUExFVEUiLgorCisKK1BBU1Mgc3VjY2Vzc2Z1bGx5UGFyc2VkIGlzIHRy dWUKKworVEVTVCBDT01QTEVURQorCkluZGV4OiBMYXlvdXRUZXN0cy9wbGF0Zm9ybS9pb3Mtc2lt L2FjY2Vzc2liaWxpdHkvb3V0LW9mLWJvdW5kcy1jaGlsZC1hY2Nlc3MuaHRtbAo9PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 Ci0tLSBMYXlvdXRUZXN0cy9wbGF0Zm9ybS9pb3Mtc2ltL2FjY2Vzc2liaWxpdHkvb3V0LW9mLWJv dW5kcy1jaGlsZC1hY2Nlc3MuaHRtbAkocmV2aXNpb24gMCkKKysrIExheW91dFRlc3RzL3BsYXRm b3JtL2lvcy1zaW0vYWNjZXNzaWJpbGl0eS9vdXQtb2YtYm91bmRzLWNoaWxkLWFjY2Vzcy5odG1s CSh3b3JraW5nIGNvcHkpCkBAIC0wLDAgKzEsMzQgQEAKKzwhRE9DVFlQRSBIVE1MIFBVQkxJQyAi LS8vSUVURi8vRFREIEhUTUwvL0VOIj4KKzxodG1sPgorPGhlYWQ+Cis8c2NyaXB0IHNyYz0iLi4v Li4vLi4vcmVzb3VyY2VzL2pzLXRlc3QtcHJlLmpzIj48L3NjcmlwdD4KKzxzY3JpcHQ+Cit2YXIg c3VjY2Vzc2Z1bGx5UGFyc2VkID0gZmFsc2U7Cis8L3NjcmlwdD4KKzwvaGVhZD4KKzxib2R5IGlk PSJib2R5Ij4KKworPGRpdiBpZD0iZ3JvdXAiIHJvbGU9Imdyb3VwIj48YnV0dG9uPnRlc3Q8L2J1 dHRvbj48L2Rpdj4KKworPHAgaWQ9ImRlc2NyaXB0aW9uIj48L3A+Cis8ZGl2IGlkPSJjb25zb2xl Ij48L2Rpdj4KKworPHNjcmlwdD4KKworICAgIGRlc2NyaXB0aW9uKCJUaGlzIG1ha2VzIHN1cmUg aWYgb3V0IG9mIGJvdW5kcyByYW5nZXMgY29tZSBpbnRvIGFjY2Vzc2liaWxpdHlFbGVtZW50QXRJ bmRleDogdGhlbiB3ZSBkb24ndCBjcmFzaC4iKTsKKworICAgIGlmICh3aW5kb3cuYWNjZXNzaWJp bGl0eUNvbnRyb2xsZXIpIHsKKworICAgICAgICB2YXIgZ3JvdXAgPSBhY2Nlc3NpYmlsaXR5Q29u dHJvbGxlci5hY2Nlc3NpYmxlRWxlbWVudEJ5SWQoImdyb3VwIik7CisKKyAgICAgICAgLy8gRG9u J3QgY3Jhc2ghCisgICAgICAgIGdyb3VwLmNoaWxkQXRJbmRleCg5MjIzMzcyMDM2ODU0Nzc1ODA2 KTsKKyAgICB9CisKKyAgICBzdWNjZXNzZnVsbHlQYXJzZWQgPSB0cnVlOworPC9zY3JpcHQ+CisK KzxzY3JpcHQgc3JjPSIuLi8uLi8uLi9yZXNvdXJjZXMvanMtdGVzdC1wb3N0LmpzIj48L3Njcmlw dD4KKzwvYm9keT4KKzwvaHRtbD4KKwo=