139856 2014-12-21 10:47:53 -0800 AX: Hidden aria table crash 2015-03-10 11:17:54 -0700 1 1 1 Unclassified WebKit Accessibility 528+ (Nightly build) All All RESOLVED FIXED InRadar P2 Normal --- 1 rgabor ggaren aboxhall apinheiro ap cfleizach commit-queue ddkilzer dmazzoni ggaren jcraig jdiggs mario samuel_white webkit-bug-importer oldest_to_newest 1057318 0 rgabor 2014-12-21 10:47:53 -0800 Hidden aria table crashing. Crashing test: <html> <body> <ul aria-hidden="true"> <table> <theader> <td> <span aria-live="assertive"></span> </td> </theader> <caption></caption> </table> </ul> <svg onerror="logPass()"></svg> </body> </html> 1057319 1 webkit-bug-importer 2014-12-21 10:48:07 -0800 <rdar://problem/19320881> 1057320 2 243614 rgabor 2014-12-21 13:30:10 -0800 Created attachment 243614 proposed fix 1057331 3 243614 commit-queue 2014-12-21 15:57:04 -0800 Comment on attachment 243614 proposed fix Clearing flags on attachment: 243614 Committed r177627: <http://trac.webkit.org/changeset/177627> 1057332 4 commit-queue 2014-12-21 15:57:08 -0800 All reviewed patches have been landed. Closing bug. 1058204 5 ap 2014-12-30 13:23:58 -0800 A test added in r177824 crashes on Mac with a RELEASE_ASSERT: https://build.webkit.org/results/Apple%20Yosemite%20Release%20WK2%20(Tests)/r177825%20(1624)/plugins/large-plugin-crash-crash-log.txt Thread 0 Crashed:: Dispatch queue: com.apple.main-thread 0 com.apple.JavaScriptCore 0x000000010867bc32 bmalloc::Heap::allocateXLarge(std::__1::lock_guard<bmalloc::StaticMutex>&, unsigned long) + 98 1 com.apple.JavaScriptCore 0x000000010867a7e7 bmalloc::Allocator::allocateXLarge(unsigned long) + 71 2 com.apple.JavaScriptCore 0x000000010865a537 WTF::fastMalloc(unsigned long) + 151 3 com.apple.JavaScriptCore 0x000000010865a5b1 WTF::tryFastMalloc(unsigned long) + 17 1058206 6 ap 2014-12-30 13:27:28 -0800 Is this the wrong bug though? This is the one referenced in ChangeLog. 1058208 7 rgabor 2014-12-30 13:44:26 -0800 (In reply to comment #6) > Is this the wrong bug though? This is the one referenced in ChangeLog. Nope, sorry I mixed bug number. The right one is https://bugs.webkit.org/show_bug.cgi?id=139868 1058229 8 commit-queue 2014-12-31 00:38:26 -0800 Re-opened since this is blocked by bug 140011 1058750 9 ddkilzer 2015-01-05 11:54:23 -0800 Looks like a regression from r176706. <http://trac.webkit.org/changeset/176706> 1075884 10 ggaren 2015-03-09 21:19:13 -0700 Reopening to attach new patch. 1075885 11 248315 ggaren 2015-03-09 21:19:16 -0700 Created attachment 248315 Patch 1075886 12 ggaren 2015-03-09 21:20:09 -0700 We should be able to re-land this test now. 1075912 13 ap 2015-03-09 23:57:59 -0700 I just rolled out the bmalloc patch, so we can't land this yet. 1075924 14 rgabor 2015-03-10 02:17:37 -0700 I think there is a missunderstanding here. These are two different bugs: AX: Hidden aria table crash: https://bugs.webkit.org/show_bug.cgi?id=139856 Too large plugins are crashing (tryFastMalloc is broken with bmalloc): https://bugs.webkit.org/show_bug.cgi?id=139868 Unfortunately when I created the fix for the second one I copy/pasted the first one bugnumber as I wrote above. Sorry for that. To make the situation more complicated the second one failed on Mac because of bmalloc and the commit bot complained on this bug not the other one. 1076001 15 248315 commit-queue 2015-03-10 11:17:48 -0700 Comment on attachment 248315 Patch Clearing flags on attachment: 248315 Committed r181330: <http://trac.webkit.org/changeset/181330> 1076002 16 commit-queue 2015-03-10 11:17:54 -0700 All reviewed patches have been landed. Closing bug. 243614 2014-12-21 13:30:10 -0800 2015-03-09 21:19:04 -0700 proposed fix proposed_fix.patch text/plain 3820 rgabor SW5kZXg6IFNvdXJjZS9XZWJDb3JlL0NoYW5nZUxvZwo9PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBTb3VyY2UvV2Vi Q29yZS9DaGFuZ2VMb2cJKHJldmlzaW9uIDE3NzYyNSkKKysrIFNvdXJjZS9XZWJDb3JlL0NoYW5n ZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDE4IEBACisyMDE0LTEyLTIxICBHYWJvciBS YXBjc2FueWkgIDxyZ2Fib3JAd2Via2l0Lm9yZz4KKworICAgICAgICBBWDogSGlkZGVuIGFyaWEg dGFibGUgY3Jhc2gKKyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dp P2lkPTEzOTg1NgorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAg ICAgIENoYW5nZSBheENhcHRpb24gdG8gcG9pbnRlciBhbmQgY2hlY2sgaXQncyB2YWx1ZSBiZWNh dXNlCisgICAgICAgIEFYT2JqZWN0Q2FjaGU6OmdldE9yQ3JlYXRlKCkgY2FuIHJldHVybiB3aXRo IG51bGxwdHIuCisKKyAgICAgICAgVGVzdDogYWNjZXNzaWJpbGl0eS9hcmlhLWhpZGRlbi1jcmFz aC5odG1sCisKKyAgICAgICAgKiBhY2Nlc3NpYmlsaXR5L0FjY2Vzc2liaWxpdHlUYWJsZS5jcHA6 CisgICAgICAgIChXZWJDb3JlOjpBY2Nlc3NpYmlsaXR5VGFibGU6OmFkZENoaWxkcmVuKToKKwog MjAxNC0xMi0yMCAgQ2hyaXMgRHVtZXogIDxjZHVtZXpAYXBwbGUuY29tPgogCiAgICAgICAgIEdl dCByaWQgb2YgZXJyb3ItcHJvbmUgUmVsZWFzZVBhcnNlZENhbGNWYWx1ZUNvbmRpdGlvbiBhcmd1 bWVudCBpbiBDU1NQYXJzZXIKSW5kZXg6IFNvdXJjZS9XZWJDb3JlL2FjY2Vzc2liaWxpdHkvQWNj ZXNzaWJpbGl0eVRhYmxlLmNwcAo9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBTb3VyY2UvV2ViQ29yZS9hY2Nlc3Np YmlsaXR5L0FjY2Vzc2liaWxpdHlUYWJsZS5jcHAJKHJldmlzaW9uIDE3NzYyMikKKysrIFNvdXJj ZS9XZWJDb3JlL2FjY2Vzc2liaWxpdHkvQWNjZXNzaWJpbGl0eVRhYmxlLmNwcAkod29ya2luZyBj b3B5KQpAQCAtMzY0LDkgKzM2NCw5IEBAIHZvaWQgQWNjZXNzaWJpbGl0eVRhYmxlOjphZGRDaGls ZHJlbigpCiAgICAgCiAgICAgaWYgKEhUTUxUYWJsZUVsZW1lbnQqIHRhYmxlRWxlbWVudCA9IHRo aXMtPnRhYmxlRWxlbWVudCgpKSB7CiAgICAgICAgIGlmIChIVE1MVGFibGVDYXB0aW9uRWxlbWVu dCogY2FwdGlvbiA9IHRhYmxlRWxlbWVudC0+Y2FwdGlvbigpKSB7Ci0gICAgICAgICAgICBBY2Nl c3NpYmlsaXR5T2JqZWN0JiBheENhcHRpb24gPSAqYXhPYmplY3RDYWNoZSgpLT5nZXRPckNyZWF0 ZShjYXB0aW9uKTsKLSAgICAgICAgICAgIGlmICghYXhDYXB0aW9uLmFjY2Vzc2liaWxpdHlJc0ln bm9yZWQoKSkKLSAgICAgICAgICAgICAgICBtX2NoaWxkcmVuLmFwcGVuZCgmYXhDYXB0aW9uKTsK KyAgICAgICAgICAgIEFjY2Vzc2liaWxpdHlPYmplY3QqIGF4Q2FwdGlvbiA9IGF4T2JqZWN0Q2Fj aGUoKS0+Z2V0T3JDcmVhdGUoY2FwdGlvbik7CisgICAgICAgICAgICBpZiAoYXhDYXB0aW9uICYm ICFheENhcHRpb24tPmFjY2Vzc2liaWxpdHlJc0lnbm9yZWQoKSkKKyAgICAgICAgICAgICAgICBt X2NoaWxkcmVuLmFwcGVuZChheENhcHRpb24pOwogICAgICAgICB9CiAgICAgfQogCkluZGV4OiBM YXlvdXRUZXN0cy9DaGFuZ2VMb2cKPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gTGF5b3V0VGVzdHMvQ2hhbmdlTG9n CShyZXZpc2lvbiAxNzc2MjUpCisrKyBMYXlvdXRUZXN0cy9DaGFuZ2VMb2cJKHdvcmtpbmcgY29w eSkKQEAgLTEsMyArMSwxNSBAQAorMjAxNC0xMi0yMSAgR2Fib3IgUmFwY3NhbnlpICA8cmdhYm9y QHdlYmtpdC5vcmc+CisKKyAgICAgICAgQVg6IEhpZGRlbiBhcmlhIHRhYmxlIGNyYXNoCisgICAg ICAgIGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD0xMzk4NTYKKworICAg ICAgICBSZXZpZXdlZCBieSBOT0JPRFkgKE9PUFMhKS4KKworICAgICAgICBBZGQgbGF5b3V0IHRl c3QgdG8gY292ZXIgdGhpcyBjcmFzaC4KKworICAgICAgICAqIGFjY2Vzc2liaWxpdHkvYXJpYS1o aWRkZW4tY3Jhc2gtZXhwZWN0ZWQudHh0OiBBZGRlZC4KKyAgICAgICAgKiBhY2Nlc3NpYmlsaXR5 L2FyaWEtaGlkZGVuLWNyYXNoLmh0bWw6IEFkZGVkLgorCiAyMDE0LTEyLTE5ICBDaHJpcyBEdW1l eiAgPGNkdW1lekBhcHBsZS5jb20+CiAKICAgICAgICAgRml4IGluaXRpYWwgLyBpbmhlcml0IHN1 cHBvcnQgZm9yICctd2Via2l0LXBlcnNwZWN0aXZlLW9yaWdpbicgQ1NTIHByb3BlcnR5CkluZGV4 OiBMYXlvdXRUZXN0cy9hY2Nlc3NpYmlsaXR5L2FyaWEtaGlkZGVuLWNyYXNoLWV4cGVjdGVkLnR4 dAo9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09Ci0tLSBMYXlvdXRUZXN0cy9hY2Nlc3NpYmlsaXR5L2FyaWEtaGlkZGVuLWNy YXNoLWV4cGVjdGVkLnR4dAkocmV2aXNpb24gMCkKKysrIExheW91dFRlc3RzL2FjY2Vzc2liaWxp dHkvYXJpYS1oaWRkZW4tY3Jhc2gtZXhwZWN0ZWQudHh0CSh3b3JraW5nIGNvcHkpCkBAIC0wLDAg KzEsNSBAQAorQnVnIDEzOTg1NjogSGlkZGVuIGFyaWEgdGFibGUgY3Jhc2guCisKK1RoaXMgdGVz dCBQQVNTRVMgaWYgaXQgZG9lcyBub3QgQ1JBU0guCisKKwpJbmRleDogTGF5b3V0VGVzdHMvYWNj ZXNzaWJpbGl0eS9hcmlhLWhpZGRlbi1jcmFzaC5odG1sCj09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIExheW91dFRl c3RzL2FjY2Vzc2liaWxpdHkvYXJpYS1oaWRkZW4tY3Jhc2guaHRtbAkocmV2aXNpb24gMCkKKysr IExheW91dFRlc3RzL2FjY2Vzc2liaWxpdHkvYXJpYS1oaWRkZW4tY3Jhc2guaHRtbAkod29ya2lu ZyBjb3B5KQpAQCAtMCwwICsxLDI3IEBACis8aHRtbD4KKyAgICA8aGVhZD4KKyAgICAgICAgPHNj cmlwdD4KKyAgICAgICAgICAgIGZ1bmN0aW9uIHRlc3QoKQorICAgICAgICAgICAgeworICAgICAg ICAgICAgICAgIGlmICh3aW5kb3cudGVzdFJ1bm5lcikKKyAgICAgICAgICAgICAgICAgICAgdGVz dFJ1bm5lci5kdW1wQXNUZXh0KCk7CisgICAgICAgICAgICB9CisgICAgICAgIDwvc2NyaXB0Pgor ICAgIDwvaGVhZD4KKyAgICA8Ym9keSBvbmxvYWQ9InRlc3QoKSI+CisgICAgICAgIDxwPkJ1ZyA8 YSBocmVmPSJodHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9MTM5ODU2Ij4x Mzk4NTY8L2E+OiBIaWRkZW4gYXJpYSB0YWJsZSBjcmFzaC48L3A+CisgICAgICAgIDxwPlRoaXMg dGVzdCBQQVNTRVMgaWYgaXQgZG9lcyBub3QgQ1JBU0guPC9wPgorCisgICAgICAgIDx1bCBhcmlh LWhpZGRlbj0idHJ1ZSI+CisgICAgICAgICAgICA8dGFibGU+CisgICAgICAgICAgICAgICAgPHRo ZWFkZXI+CisgICAgICAgICAgICAgICAgICAgIDx0ZD4KKyAgICAgICAgICAgICAgICAgICAgICAg IDxzcGFuIGFyaWEtbGl2ZT0iYXNzZXJ0aXZlIj48L3NwYW4+CisgICAgICAgICAgICAgICAgICAg IDwvdGQ+CisgICAgICAgICAgICAgICAgPC90aGVhZGVyPgorICAgICAgICAgICAgICAgIDxjYXB0 aW9uPjwvY2FwdGlvbj4KKyAgICAgICAgICAgIDwvdGFibGU+CisgICAgICAgIDwvdWw+CisgICAg ICAgIDxzdmcgb25lcnJvcj0ibG9nUGFzcygpIj48L3N2Zz4KKyAgICA8L2JvZHk+Cis8L2h0bWw+ Cg== 248315 2015-03-09 21:19:16 -0700 2015-03-10 11:17:48 -0700 Patch bug-139856-20150309211852.patch text/plain 1783 ggaren SW5kZXg6IExheW91dFRlc3RzL0NoYW5nZUxvZwo9PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBMYXlvdXRUZXN0cy9D aGFuZ2VMb2cJKHJldmlzaW9uIDE4MTMwNikKKysrIExheW91dFRlc3RzL0NoYW5nZUxvZwkod29y a2luZyBjb3B5KQpAQCAtMSwzICsxLDE1IEBACisyMDE1LTAzLTA5ICBHYWJvciBSYXBjc2FueWkg IDxyZ2Fib3JAd2Via2l0Lm9yZz4KKworICAgICAgICBUb28gbGFyZ2UgcGx1Z2lucyBhcmUgY3Jh c2hpbmcuCisgICAgICAgIGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD0x Mzk4NTYKKworICAgICAgICBSZXZpZXdlZCBieSBOT0JPRFkgKE9PUFMhKS4KKworICAgICAgICBB ZGQgbGF5b3V0IHRlc3QgdG8gY292ZXIgdGhpcyBjcmFzaC4KKworICAgICAgICAqIHBsdWdpbnMv bGFyZ2UtcGx1Z2luLWNyYXNoLWV4cGVjdGVkLnR4dDogQWRkZWQuCisgICAgICAgICogcGx1Z2lu cy9sYXJnZS1wbHVnaW4tY3Jhc2guaHRtbDogQWRkZWQuCisKIDIwMTUtMDMtMDkgIEJyZW50IEZ1 bGdoYW0gIDxiZnVsZ2hhbUBhcHBsZS5jb20+CiAKICAgICAgICAgW1dpbl0gUmViYXNlbGluZSB0 ZXN0cyBhZmVyIHIxODEyOTIuCkluZGV4OiBMYXlvdXRUZXN0cy9wbHVnaW5zL2xhcmdlLXBsdWdp bi1jcmFzaC1leHBlY3RlZC50eHQKPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gTGF5b3V0VGVzdHMvcGx1Z2lucy9s YXJnZS1wbHVnaW4tY3Jhc2gtZXhwZWN0ZWQudHh0CShyZXZpc2lvbiAwKQorKysgTGF5b3V0VGVz dHMvcGx1Z2lucy9sYXJnZS1wbHVnaW4tY3Jhc2gtZXhwZWN0ZWQudHh0CSh3b3JraW5nIGNvcHkp CkBAIC0wLDAgKzEsNSBAQAorQnVnIDEzOTg1NjogTGFyZ2UgcGx1Z2luIGNyYXNoLgorCitUaGlz IHRlc3QgUEFTU0VTIGlmIGl0IGRvZXMgbm90IENSQVNILgorCisKSW5kZXg6IExheW91dFRlc3Rz L3BsdWdpbnMvbGFyZ2UtcGx1Z2luLWNyYXNoLmh0bWwKPT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gTGF5b3V0VGVz dHMvcGx1Z2lucy9sYXJnZS1wbHVnaW4tY3Jhc2guaHRtbAkocmV2aXNpb24gMCkKKysrIExheW91 dFRlc3RzL3BsdWdpbnMvbGFyZ2UtcGx1Z2luLWNyYXNoLmh0bWwJKHdvcmtpbmcgY29weSkKQEAg LTAsMCArMSwxNSBAQAorPGh0bWw+CisgICAgPGJvZHk+CisgICAgICAgIDxwPkJ1ZyA8YSBocmVm PSJodHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9MTM5ODU2Ij4xMzk4NTY8 L2E+OiBMYXJnZSBwbHVnaW4gY3Jhc2guPC9wPgorICAgICAgICA8cD5UaGlzIHRlc3QgUEFTU0VT IGlmIGl0IGRvZXMgbm90IENSQVNILjwvcD4KKworICAgICAgICA8ZW1iZWQgaWQ9InBsdWdpbiIg d2lkdGg9Ijk5OTk5OTk5OTk5OTk5OTk5IiB0eXBlPSJhcHBsaWNhdGlvbi94LXdlYmtpdC10ZXN0 LW5ldHNjYXBlIj48L2VtYmVkPgorCisgICAgICAgIDxzY3JpcHQ+CisgICAgICAgICAgICBpZiAo d2luZG93LnRlc3RSdW5uZXIpCisgICAgICAgICAgICAgICAgdGVzdFJ1bm5lci5kdW1wQXNUZXh0 KCk7CisgICAgICAgICAgICBkb2N1bWVudC5nZXRFbGVtZW50QnlJZCgncGx1Z2luJykuc3R5bGUu d2Via2l0VHJhbnNmb3JtID0gJ3NjYWxlKDEpJzsKKyAgICAgICAgPC9zY3JpcHQ+CisKKyAgICA8 L2JvZHk+Cis8L2h0bWw+Cg==