<?xml version="1.0" encoding="UTF-8" standalone="yes" ?>
<!DOCTYPE bugzilla SYSTEM "https://bugs.webkit.org/page.cgi?id=bugzilla.dtd">

<bugzilla version="5.0.4.1"
          urlbase="https://bugs.webkit.org/"
          
          maintainer="admin@webkit.org"
>

    <bug>
          <bug_id>186629</bug_id>
          
          <creation_ts>2018-06-14 12:52:19 -0700</creation_ts>
          <short_desc>AX: Crash in AccessibilityNodeObject::textUnderElement(WebCore::AccessibilityTextUnderElementMode) const + 536</short_desc>
          <delta_ts>2018-06-14 14:11:18 -0700</delta_ts>
          <reporter_accessible>1</reporter_accessible>
          <cclist_accessible>1</cclist_accessible>
          <classification_id>1</classification_id>
          <classification>Unclassified</classification>
          <product>WebKit</product>
          <component>Accessibility</component>
          <version>WebKit Nightly Build</version>
          <rep_platform>All</rep_platform>
          <op_sys>All</op_sys>
          <bug_status>RESOLVED</bug_status>
          <resolution>FIXED</resolution>
          
          
          <bug_file_loc></bug_file_loc>
          <status_whiteboard></status_whiteboard>
          <keywords>InRadar</keywords>
          <priority>P2</priority>
          <bug_severity>Normal</bug_severity>
          <target_milestone>---</target_milestone>
          
          
          <everconfirmed>1</everconfirmed>
          <reporter name="Nan Wang">n_wang</reporter>
          <assigned_to name="Nobody">webkit-unassigned</assigned_to>
          <cc>aboxhall</cc>
    
    <cc>apinheiro</cc>
    
    <cc>cfleizach</cc>
    
    <cc>commit-queue</cc>
    
    <cc>dmazzoni</cc>
    
    <cc>ews-watchlist</cc>
    
    <cc>jcraig</cc>
    
    <cc>jdiggs</cc>
    
    <cc>n_wang</cc>
    
    <cc>samuel_white</cc>
    
    <cc>webkit-bug-importer</cc>
          

      

      

      

          <comment_sort_order>oldest_to_newest</comment_sort_order>  
          <long_desc isprivate="0" >
    <commentid>1433083</commentid>
    <comment_count>0</comment_count>
    <who name="Nan Wang">n_wang</who>
    <bug_when>2018-06-14 12:52:19 -0700</bug_when>
    <thetext>0   WebCore                       	0x00000001977d4b68 WebCore::AccessibilityNodeObject::textUnderElement(WebCore::AccessibilityTextUnderElementMode) const + 536 
1   WebCore                       	0x00000001977d4b38 WebCore::AccessibilityNodeObject::textUnderElement(WebCore::AccessibilityTextUnderElementMode) const + 488 
2   WebCore                       	0x00000001977e40f4 WebCore::AccessibilityRenderObject::textUnderElement(WebCore::AccessibilityTextUnderElementMode) const + 876 (./accessibility/AccessibilityRenderObject.cpp:689)
3   WebCore                       	0x00000001977d5104 WebCore::AccessibilityNodeObject::textUnderElement(WebCore::AccessibilityTextUnderElementMode) const + 1972 (./accessibility/AccessibilityNodeObject.cpp:1779)
4   WebCore                       	0x00000001977e40f4 WebCore::AccessibilityRenderObject::textUnderElement(WebCore::AccessibilityTextUnderElementMode) const + 876 (./accessibility/AccessibilityRenderObject.cpp:689)
5   WebCore                       	0x00000001977d0224 WebCore::accessibleNameForNode(WebCore::Node*, WebCore::Node*) + 1304 (./accessibility/AccessibilityNodeObject.cpp:1986)
6   WebCore                       	0x00000001977d6438 WebCore::AccessibilityNodeObject::accessibilityDescriptionForElements(WTF::Vector&lt;WebCore::Element*, 0ul, WTF::CrashOnOverflow, 16ul&gt;&amp;) const + 108 (./accessibility/AccessibilityNodeObject.cpp:2031)
7   WebCore                       	0x00000001977d680c WebCore::AccessibilityNodeObject::ariaLabeledByAttribute() const + 88 (./accessibility/AccessibilityNodeObject.cpp:2056)
8   WebCore                       	0x00000001977d26a0 WebCore::AccessibilityNodeObject::ariaLabeledByText(WTF::Vector&lt;WebCore::AccessibilityText, 0ul, WTF::CrashOnOverflow, 16ul&gt;&amp;) const + 56 (./accessibility/AccessibilityNodeObject.cpp:1478)
9   WebCore                       	0x00000001977d0aec WebCore::AccessibilityNodeObject::alternativeText(WTF::Vector&lt;WebCore::AccessibilityText, 0ul, WTF::CrashOnOverflow, 16ul&gt;&amp;) const + 248 (./accessibility/AccessibilityNodeObject.cpp:1315)
10  WebCore                       	0x00000001977d3ba0 WebCore::AccessibilityNodeObject::accessibilityText(WTF::Vector&lt;WebCore::AccessibilityText, 0ul, WTF::CrashOnOverflow, 16ul&gt;&amp;) + 52 (./accessibility/AccessibilityNodeObject.cpp:1467)
11  WebCore                       	0x000000019837590c -[WebAccessibilityObjectWrapperBase baseAccessibilityTitle] + 220 (/BuildRoot/Library/Caches/com.apple.xbs/Sources/WebCore/WebCore-7606.1.19.1/accessibility/mac/WebAccessibilityObjectWrapperBase.mm:338)
12  WebCore                       	0x0000000196fa5a64 -[WebAccessibilityObjectWrapper accessibilityLabel] + 100 (./accessibility/ios/WebAccessibilityObjectWrapperIOS.mm:1132)

&lt;rdar://problem/40828348&gt;</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1433085</commentid>
    <comment_count>1</comment_count>
      <attachid>342755</attachid>
    <who name="Nan Wang">n_wang</who>
    <bug_when>2018-06-14 12:56:32 -0700</bug_when>
    <thetext>Created attachment 342755
patch</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1433102</commentid>
    <comment_count>2</comment_count>
      <attachid>342755</attachid>
    <who name="WebKit Commit Bot">commit-queue</who>
    <bug_when>2018-06-14 14:11:17 -0700</bug_when>
    <thetext>Comment on attachment 342755
patch

Clearing flags on attachment: 342755

Committed r232852: &lt;https://trac.webkit.org/changeset/232852&gt;</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1433103</commentid>
    <comment_count>3</comment_count>
    <who name="WebKit Commit Bot">commit-queue</who>
    <bug_when>2018-06-14 14:11:18 -0700</bug_when>
    <thetext>All reviewed patches have been landed.  Closing bug.</thetext>
  </long_desc>
      
          <attachment
              isobsolete="0"
              ispatch="1"
              isprivate="0"
          >
            <attachid>342755</attachid>
            <date>2018-06-14 12:56:32 -0700</date>
            <delta_ts>2018-06-14 14:11:17 -0700</delta_ts>
            <desc>patch</desc>
            <filename>patch.txt</filename>
            <type>text/plain</type>
            <size>4453</size>
            <attacher name="Nan Wang">n_wang</attacher>
            
              <data encoding="base64">SW5kZXg6IFNvdXJjZS9XZWJDb3JlL0NoYW5nZUxvZwo9PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBTb3VyY2UvV2Vi
Q29yZS9DaGFuZ2VMb2cJKHJldmlzaW9uIDIzMjg0NykKKysrIFNvdXJjZS9XZWJDb3JlL0NoYW5n
ZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDE4IEBACisyMDE4LTA2LTE0ICBOYW4gV2Fu
ZyAgPG5fd2FuZ0BhcHBsZS5jb20+CisKKyAgICAgICAgQVg6IENyYXNoIGluIEFjY2Vzc2liaWxp
dHlOb2RlT2JqZWN0Ojp0ZXh0VW5kZXJFbGVtZW50KFdlYkNvcmU6OkFjY2Vzc2liaWxpdHlUZXh0
VW5kZXJFbGVtZW50TW9kZSkgY29uc3QgKyA1MzYKKyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtp
dC5vcmcvc2hvd19idWcuY2dpP2lkPTE4NjYyOQorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9E
WSAoT09QUyEpLgorCisgICAgICAgIFRoaXMgY3Jhc2hlZCB3aGVuIHdlIHBhc3NlZCBhIG51bGwg
bm9kZSB0byBhbmNlc3RvcnNPZlR5cGUuIEZpeGVkIGl0CisgICAgICAgIGJ5IGFkZGluZyBhIG51
bGwgY2hlY2suCisKKyAgICAgICAgVGVzdDogYWNjZXNzaWJpbGl0eS9oaWRkZW4tb2JqZWN0LXRl
eHQtdmFsdWUtY3Jhc2guaHRtbAorCisgICAgICAgICogYWNjZXNzaWJpbGl0eS9BY2Nlc3NpYmls
aXR5Tm9kZU9iamVjdC5jcHA6CisgICAgICAgIChXZWJDb3JlOjpBY2Nlc3NpYmlsaXR5Tm9kZU9i
amVjdDo6dGV4dFVuZGVyRWxlbWVudCBjb25zdCk6CisKIDIwMTgtMDYtMTQgIFRpbW90aHkgSGF0
Y2hlciAgPHRpbW90aHlAYXBwbGUuY29tPgogCiAgICAgICAgIEV4cG9zZSBtb3JlIHNlbWFudGlj
IHN5c3RlbSBjb2xvcnMuCkluZGV4OiBTb3VyY2UvV2ViQ29yZS9hY2Nlc3NpYmlsaXR5L0FjY2Vz
c2liaWxpdHlOb2RlT2JqZWN0LmNwcAo9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBTb3VyY2UvV2ViQ29yZS9hY2Nl
c3NpYmlsaXR5L0FjY2Vzc2liaWxpdHlOb2RlT2JqZWN0LmNwcAkocmV2aXNpb24gMjMyNzc0KQor
KysgU291cmNlL1dlYkNvcmUvYWNjZXNzaWJpbGl0eS9BY2Nlc3NpYmlsaXR5Tm9kZU9iamVjdC5j
cHAJKHdvcmtpbmcgY29weSkKQEAgLTE3NDQsNyArMTc0NCw3IEBAIFN0cmluZyBBY2Nlc3NpYmls
aXR5Tm9kZU9iamVjdDo6dGV4dFVuZGUKICAgICAvLyBUaGUgQWNjbmFtZSBzcGVjaWZpY2F0aW9u
IHN0YXRlcyB0aGF0IGlmIHRoZSBjdXJyZW50IG5vZGUgaXMgaGlkZGVuLCBhbmQgbm90IGRpcmVj
dGx5CiAgICAgLy8gcmVmZXJlbmNlZCBieSBhcmlhLWxhYmVsbGVkYnkgb3IgYXJpYS1kZXNjcmli
ZWRieSwgYW5kIGlzIG5vdCBhIGhvc3QgbGFuZ3VhZ2UgdGV4dAogICAgIC8vIGFsdGVybmF0aXZl
LCB0aGUgZW1wdHkgc3RyaW5nIHNob3VsZCBiZSByZXR1cm5lZC4KLSAgICBpZiAoaXNIaWRkZW4o
KSAmJiAhaXM8SFRNTExhYmVsRWxlbWVudD4obm9kZSkgJiYgIWFuY2VzdG9yc09mVHlwZTxIVE1M
Q2FudmFzRWxlbWVudD4oKm5vZGUpLmZpcnN0KCkpIHsKKyAgICBpZiAoaXNIaWRkZW4oKSAmJiAh
aXM8SFRNTExhYmVsRWxlbWVudD4obm9kZSkgJiYgKG5vZGUgJiYgIWFuY2VzdG9yc09mVHlwZTxI
VE1MQ2FudmFzRWxlbWVudD4oKm5vZGUpLmZpcnN0KCkpKSB7CiAgICAgICAgIEFjY2Vzc2liaWxp
dHlPYmplY3Q6OkFjY2Vzc2liaWxpdHlDaGlsZHJlblZlY3RvciBsYWJlbEZvcjsKICAgICAgICAg
QWNjZXNzaWJpbGl0eU9iamVjdDo6QWNjZXNzaWJpbGl0eUNoaWxkcmVuVmVjdG9yIGRlc2NyaXB0
aW9uRm9yOwogICAgICAgICBhcmlhTGFiZWxsZWRCeVJlZmVyZW5jaW5nRWxlbWVudHMobGFiZWxG
b3IpOwpJbmRleDogTGF5b3V0VGVzdHMvQ2hhbmdlTG9nCj09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIExheW91dFRl
c3RzL0NoYW5nZUxvZwkocmV2aXNpb24gMjMyNzc0KQorKysgTGF5b3V0VGVzdHMvQ2hhbmdlTG9n
CSh3b3JraW5nIGNvcHkpCkBAIC0xLDMgKzEsMTMgQEAKKzIwMTgtMDYtMTQgIE5hbiBXYW5nICA8
bl93YW5nQGFwcGxlLmNvbT4KKworICAgICAgICBBWDogQ3Jhc2ggaW4gQWNjZXNzaWJpbGl0eU5v
ZGVPYmplY3Q6OnRleHRVbmRlckVsZW1lbnQoV2ViQ29yZTo6QWNjZXNzaWJpbGl0eVRleHRVbmRl
ckVsZW1lbnRNb2RlKSBjb25zdCArIDUzNgorICAgICAgICBodHRwczovL2J1Z3Mud2Via2l0Lm9y
Zy9zaG93X2J1Zy5jZ2k/aWQ9MTg2NjI5CisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChP
T1BTISkuCisKKyAgICAgICAgKiBhY2Nlc3NpYmlsaXR5L2hpZGRlbi1vYmplY3QtdGV4dC12YWx1
ZS1jcmFzaC1leHBlY3RlZC50eHQ6IEFkZGVkLgorICAgICAgICAqIGFjY2Vzc2liaWxpdHkvaGlk
ZGVuLW9iamVjdC10ZXh0LXZhbHVlLWNyYXNoLmh0bWw6IEFkZGVkLgorCiAyMDE4LTA2LTEyICBa
YWxhbiBCdWp0YXMgIDx6YWxhbkBhcHBsZS5jb20+CiAKICAgICAgICAgQ29tcGxleCB0ZXh0IGhh
bmRsaW5nIHNob3VsZCBvcHQgb3V0IG9mIGJvdW5kZWQgdGV4dCBsYXlvdXQuCkluZGV4OiBMYXlv
dXRUZXN0cy9hY2Nlc3NpYmlsaXR5L2hpZGRlbi1vYmplY3QtdGV4dC12YWx1ZS1jcmFzaC1leHBl
Y3RlZC50eHQKPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PQotLS0gTGF5b3V0VGVzdHMvYWNjZXNzaWJpbGl0eS9oaWRkZW4t
b2JqZWN0LXRleHQtdmFsdWUtY3Jhc2gtZXhwZWN0ZWQudHh0CShub25leGlzdGVudCkKKysrIExh
eW91dFRlc3RzL2FjY2Vzc2liaWxpdHkvaGlkZGVuLW9iamVjdC10ZXh0LXZhbHVlLWNyYXNoLWV4
cGVjdGVkLnR4dAkod29ya2luZyBjb3B5KQpAQCAtMCwwICsxLDEzIEBACisKK2NsaWNrCitEZXNj
cmlwdGlvbiB0ZXh0CisKK1RoaXMgdGVzdHMgdGhhdCBpdCB3b24ndCBjYXVzZSBhIGNyYXNoIHdo
ZW4gY29tcHV0aW5nIHRoZSB0ZXh0IHZhbHVlIG9mIGFuIEFYIG9iamVjdCB0aGF0IGlzIGhpZGRl
biBhbmQgaGFzIG5vIG5vZGUuCisKK09uIHN1Y2Nlc3MsIHlvdSB3aWxsIHNlZSBhIHNlcmllcyBv
ZiAiUEFTUyIgbWVzc2FnZXMsIGZvbGxvd2VkIGJ5ICJURVNUIENPTVBMRVRFIi4KKworCitQQVNT
IHN1Y2Nlc3NmdWxseVBhcnNlZCBpcyB0cnVlCisKK1RFU1QgQ09NUExFVEUKKwpJbmRleDogTGF5
b3V0VGVzdHMvYWNjZXNzaWJpbGl0eS9oaWRkZW4tb2JqZWN0LXRleHQtdmFsdWUtY3Jhc2guaHRt
bAo9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09Ci0tLSBMYXlvdXRUZXN0cy9hY2Nlc3NpYmlsaXR5L2hpZGRlbi1vYmplY3Qt
dGV4dC12YWx1ZS1jcmFzaC5odG1sCShub25leGlzdGVudCkKKysrIExheW91dFRlc3RzL2FjY2Vz
c2liaWxpdHkvaGlkZGVuLW9iamVjdC10ZXh0LXZhbHVlLWNyYXNoLmh0bWwJKHdvcmtpbmcgY29w
eSkKQEAgLTAsMCArMSwzOSBAQAorPCFET0NUWVBFIEhUTUwgUFVCTElDICItLy9JRVRGLy9EVEQg
SFRNTC8vRU4iPgorPGh0bWw+Cis8aGVhZD4KKzxzY3JpcHQgc3JjPSIuLi9yZXNvdXJjZXMvanMt
dGVzdC1wcmUuanMiPjwvc2NyaXB0PgorPC9oZWFkPgorPHN0eWxlPgorc3Bhbjo6YmVmb3JlIHsK
KyAgICBjb250ZW50OiAiQmVmb3JlIjsKK30KKzwvc3R5bGU+Cis8Ym9keSBpZD0iYm9keSI+CisK
KzxidXR0b24gaWQ9ImJ1dHRvbiIgdHlwZT0iYnV0dG9uIiBhcmlhLWhpZGRlbj0idHJ1ZSIgYXJp
YS1oYXNwb3B1cD0idHJ1ZSI+PHNwYW4+PC9zcGFuPjwvYnV0dG9uPgorPGRpdiBpZD0iYnV0dG9u
MiIgYXJpYS1sYWJlbGxlZGJ5PSJidXR0b24iPgorPGJ1dHRvbj5jbGljazwvYnV0dG9uPgorPC9k
aXY+CisKKzxwPkRlc2NyaXB0aW9uIHRleHQ8L3A+Cis8L2Rpdj4KKworPHAgaWQ9ImRlc2NyaXB0
aW9uIj48L3A+Cis8ZGl2IGlkPSJjb25zb2xlIj48L2Rpdj4KKworPHNjcmlwdD4KKworICAgIGRl
c2NyaXB0aW9uKCJUaGlzIHRlc3RzIHRoYXQgaXQgd29uJ3QgY2F1c2UgYSBjcmFzaCB3aGVuIGNv
bXB1dGluZyB0aGUgdGV4dCB2YWx1ZSBvZiBhbiBBWCBvYmplY3QgdGhhdCBpcyBoaWRkZW4gYW5k
IGhhcyBubyBub2RlLiIpOworCisgICAgaWYgKHdpbmRvdy5hY2Nlc3NpYmlsaXR5Q29udHJvbGxl
cikgeworCisgICAgICAgIHZhciBidXR0b24gPSBhY2Nlc3NpYmlsaXR5Q29udHJvbGxlci5hY2Nl
c3NpYmxlRWxlbWVudEJ5SWQoImJ1dHRvbjIiKTsKKyAgICAgICAgLy8gRG8gbm90IGNyYXNoCisg
ICAgICAgIGJ1dHRvbi5kZXNjcmlwdGlvbjsKKyAgICB9CisKKzwvc2NyaXB0PgorCis8c2NyaXB0
IHNyYz0iLi4vcmVzb3VyY2VzL2pzLXRlc3QtcG9zdC5qcyI+PC9zY3JpcHQ+Cis8L2JvZHk+Cis8
L2h0bWw+Cg==
</data>

          </attachment>
      

    </bug>

</bugzilla>