<?xml version="1.0" encoding="UTF-8" standalone="yes" ?>
<!DOCTYPE bugzilla SYSTEM "https://bugs.webkit.org/page.cgi?id=bugzilla.dtd">

<bugzilla version="5.0.4.1"
          urlbase="https://bugs.webkit.org/"
          
          maintainer="admin@webkit.org"
>

    <bug>
          <bug_id>23509</bug_id>
          
          <creation_ts>2009-01-23 14:40:33 -0800</creation_ts>
          <short_desc>Crash at -[WebCoreAXObject doAXNextSentenceEndTextMarkerForTextMarker:]</short_desc>
          <delta_ts>2009-01-23 17:21:52 -0800</delta_ts>
          <reporter_accessible>1</reporter_accessible>
          <cclist_accessible>1</cclist_accessible>
          <classification_id>1</classification_id>
          <classification>Unclassified</classification>
          <product>WebKit</product>
          <component>Accessibility</component>
          <version>528+ (Nightly build)</version>
          <rep_platform>Mac</rep_platform>
          <op_sys>OS X 10.5</op_sys>
          <bug_status>RESOLVED</bug_status>
          <resolution>FIXED</resolution>
          
          
          <bug_file_loc></bug_file_loc>
          <status_whiteboard></status_whiteboard>
          <keywords></keywords>
          <priority>P2</priority>
          <bug_severity>Normal</bug_severity>
          <target_milestone>---</target_milestone>
          
          
          <everconfirmed>1</everconfirmed>
          <reporter name="chris fleizach">cfleizach</reporter>
          <assigned_to name="Nobody">webkit-unassigned</assigned_to>
          
          

      

      

      

          <comment_sort_order>oldest_to_newest</comment_sort_order>  
          <long_desc isprivate="0" >
    <commentid>106804</commentid>
    <comment_count>0</comment_count>
    <who name="chris fleizach">cfleizach</who>
    <bug_when>2009-01-23 14:40:33 -0800</bug_when>
    <thetext>WebKit can crash at this position when startOfLine returns null</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>106805</commentid>
    <comment_count>1</comment_count>
      <attachid>26984</attachid>
    <who name="chris fleizach">cfleizach</who>
    <bug_when>2009-01-23 14:42:01 -0800</bug_when>
    <thetext>Created attachment 26984
patch to stop a crasher</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>106806</commentid>
    <comment_count>2</comment_count>
    <who name="chris fleizach">cfleizach</who>
    <bug_when>2009-01-23 14:42:56 -0800</bug_when>
    <thetext>no good steps to reproduce listed in the bug, but the backtrace is pretty clear as to what&apos;s happening. as a result, i could not devise a layout test to that elicited the crash</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>106808</commentid>
    <comment_count>3</comment_count>
    <who name="chris fleizach">cfleizach</who>
    <bug_when>2009-01-23 15:03:44 -0800</bug_when>
    <thetext>http://trac.webkit.org/changeset/40191</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>106816</commentid>
    <comment_count>4</comment_count>
      <attachid>26984</attachid>
    <who name="Darin Adler">darin</who>
    <bug_when>2009-01-23 16:12:35 -0800</bug_when>
    <thetext>Comment on attachment 26984
patch to stop a crasher

Seems to me that makeRange should probably return 0 if passed null positions. And plainText already handles the case where the range is 0. So I would suggest fixing this in the makeRange function rather than in the AccessibilityObject class.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>106819</commentid>
    <comment_count>5</comment_count>
      <attachid>26987</attachid>
    <who name="chris fleizach">cfleizach</who>
    <bug_when>2009-01-23 16:23:47 -0800</bug_when>
    <thetext>Created attachment 26987
new patch based on review</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>106820</commentid>
    <comment_count>6</comment_count>
    <who name="chris fleizach">cfleizach</who>
    <bug_when>2009-01-23 16:24:12 -0800</bug_when>
    <thetext>updated patch based on Darin&apos;s review</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>106821</commentid>
    <comment_count>7</comment_count>
    <who name="chris fleizach">cfleizach</who>
    <bug_when>2009-01-23 16:24:48 -0800</bug_when>
    <thetext>Darin, is this what you had in mind

(In reply to comment #4)
&gt; (From update of attachment 26984 [review])
&gt; Seems to me that makeRange should probably return 0 if passed null positions.
&gt; And plainText already handles the case where the range is 0. So I would suggest
&gt; fixing this in the makeRange function rather than in the AccessibilityObject
&gt; class.
&gt; 

</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>106823</commentid>
    <comment_count>8</comment_count>
      <attachid>26987</attachid>
    <who name="Darin Adler">darin</who>
    <bug_when>2009-01-23 17:18:02 -0800</bug_when>
    <thetext>Comment on attachment 26987
new patch based on review

r=me</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>106824</commentid>
    <comment_count>9</comment_count>
    <who name="chris fleizach">cfleizach</who>
    <bug_when>2009-01-23 17:21:52 -0800</bug_when>
    <thetext>http://trac.webkit.org/changeset/40202</thetext>
  </long_desc>
      
          <attachment
              isobsolete="0"
              ispatch="1"
              isprivate="0"
          >
            <attachid>26984</attachid>
            <date>2009-01-23 14:42:01 -0800</date>
            <delta_ts>2009-01-23 15:00:33 -0800</delta_ts>
            <desc>patch to stop a crasher</desc>
            <filename>patch.txt</filename>
            <type>text/plain</type>
            <size>2549</size>
            <attacher name="chris fleizach">cfleizach</attacher>
            
              <data encoding="base64">SW5kZXg6IFdlYkNvcmUvQ2hhbmdlTG9nCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIFdlYkNvcmUvQ2hhbmdlTG9n
CShyZXZpc2lvbiA0MDE4NykKKysrIFdlYkNvcmUvQ2hhbmdlTG9nCSh3b3JraW5nIGNvcHkpCkBA
IC0xLDMgKzEsMTYgQEAKKzIwMDktMDEtMjMgIENocmlzIEZsZWl6YWNoICA8Y2ZsZWl6YWNoQGFw
cGxlLmNvbT4KKworICAgICAgICBSZXZpZXdlZCBieSBOT0JPRFkgKE9PUFMhKS4KKworICAgICAg
ICBCdWcgMjM1MDk6IENyYXNoIGF0IC1bV2ViQ29yZUFYT2JqZWN0IGRvQVhOZXh0U2VudGVuY2VF
bmRUZXh0TWFya2VyRm9yVGV4dE1hcmtlcjpdCisgICAgICAgIGh0dHBzOi8vYnVncy53ZWJraXQu
b3JnL3Nob3dfYnVnLmNnaT9pZD0yMzUwOQorICAKKyAgICAgICAgQWRkIG51bGwgY2hlY2tpbmcg
YXJvdW5kIG5leHQvcHJldmlvdXMgc2VudGVuY2UgcmV0cmlldmFsIGluIEFYIGNvZGUKKworICAg
ICAgICAqIHBhZ2UvQWNjZXNzaWJpbGl0eU9iamVjdC5jcHA6CisgICAgICAgIChXZWJDb3JlOjpB
Y2Nlc3NpYmlsaXR5T2JqZWN0OjpuZXh0U2VudGVuY2VFbmRQb3NpdGlvbik6CisgICAgICAgIChX
ZWJDb3JlOjpBY2Nlc3NpYmlsaXR5T2JqZWN0OjpwcmV2aW91c1NlbnRlbmNlU3RhcnRQb3NpdGlv
bik6CisKIDIwMDktMDEtMjMgIERhdmlkIEh5YXR0ICA8aHlhdHRAYXBwbGUuY29tPgogCiAgICAg
ICAgIEZpeCBmb3IgPHJkYXI6Ly9wcm9ibGVtLzY1MTg4NTA+IFJFR1JFU1NJT046IGhvdmVyIGZl
ZWRiYWNrIG5vdCBzaG93aW5nIG9uIG1hbnkgc2l0ZXMKSW5kZXg6IFdlYkNvcmUvcGFnZS9BY2Nl
c3NpYmlsaXR5T2JqZWN0LmNwcAo9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBXZWJDb3JlL3BhZ2UvQWNjZXNzaWJp
bGl0eU9iamVjdC5jcHAJKHJldmlzaW9uIDQwMTgxKQorKysgV2ViQ29yZS9wYWdlL0FjY2Vzc2li
aWxpdHlPYmplY3QuY3BwCSh3b3JraW5nIGNvcHkpCkBAIC03MzksNyArNzM5LDEzIEBAIFZpc2li
bGVQb3NpdGlvbiBBY2Nlc3NpYmlsaXR5T2JqZWN0OjpuZXgKICAgICAvLyBhbiBlbXB0eSBsaW5l
IGlzIGNvbnNpZGVyZWQgYSBzZW50ZW5jZS4gSWYgaXQncyBza2lwcGVkLCB0aGVuIHRoZSBzZW50
ZW5jZSBwYXJzZXIgd2lsbCBub3QKICAgICAvLyBzZWUgdGhpcyBlbXB0eSBsaW5lLiAgSW5zdGVh
ZCwgcmV0dXJuIHRoZSBlbmQgcG9zaXRpb24gb2YgdGhlIGVtcHR5IGxpbmUuCiAgICAgVmlzaWJs
ZVBvc2l0aW9uIGVuZFBvc2l0aW9uOwotICAgIFN0cmluZyBsaW5lU3RyaW5nID0gcGxhaW5UZXh0
KG1ha2VSYW5nZShzdGFydE9mTGluZSh2aXNpYmxlUG9zKSwgZW5kT2ZMaW5lKHZpc2libGVQb3Mp
KS5nZXQoKSk7CisgICAgVmlzaWJsZVBvc2l0aW9uIHN0YXJ0T2ZMaW5lUG9zaXRpb24gPSBzdGFy
dE9mTGluZShuZXh0VmlzaWJsZVBvcyk7CisgICAgVmlzaWJsZVBvc2l0aW9uIGVuZE9mTGluZVBv
c2l0aW9uID0gZW5kT2ZMaW5lKG5leHRWaXNpYmxlUG9zKTsKKworICAgIFN0cmluZyBsaW5lU3Ry
aW5nOworICAgIGlmIChzdGFydE9mTGluZVBvc2l0aW9uLmlzTm90TnVsbCgpICYmIGVuZE9mTGlu
ZVBvc2l0aW9uLmlzTm90TnVsbCgpKQorICAgICAgICBsaW5lU3RyaW5nID0gcGxhaW5UZXh0KG1h
a2VSYW5nZShzdGFydE9mTGluZVBvc2l0aW9uLCBlbmRPZkxpbmVQb3NpdGlvbikuZ2V0KCkpOwor
CiAgICAgaWYgKGxpbmVTdHJpbmcuaXNFbXB0eSgpKQogICAgICAgICBlbmRQb3NpdGlvbiA9IG5l
eHRWaXNpYmxlUG9zOwogICAgIGVsc2UKQEAgLTc2Miw3ICs3NjgsMTMgQEAgVmlzaWJsZVBvc2l0
aW9uIEFjY2Vzc2liaWxpdHlPYmplY3Q6OnByZQogCiAgICAgLy8gdHJlYXQgZW1wdHkgbGluZSBh
cyBhIHNlcGFyYXRlIHNlbnRlbmNlLgogICAgIFZpc2libGVQb3NpdGlvbiBzdGFydFBvc2l0aW9u
OwotICAgIFN0cmluZyBsaW5lU3RyaW5nID0gcGxhaW5UZXh0KG1ha2VSYW5nZShzdGFydE9mTGlu
ZShwcmV2aW91c1Zpc2libGVQb3MpLCBlbmRPZkxpbmUocHJldmlvdXNWaXNpYmxlUG9zKSkuZ2V0
KCkpOworICAgIFZpc2libGVQb3NpdGlvbiBzdGFydE9mTGluZVBvc2l0aW9uID0gc3RhcnRPZkxp
bmUocHJldmlvdXNWaXNpYmxlUG9zKTsKKyAgICBWaXNpYmxlUG9zaXRpb24gZW5kT2ZMaW5lUG9z
aXRpb24gPSBlbmRPZkxpbmUocHJldmlvdXNWaXNpYmxlUG9zKTsKKyAgICAKKyAgICBTdHJpbmcg
bGluZVN0cmluZzsKKyAgICBpZiAoc3RhcnRPZkxpbmVQb3NpdGlvbi5pc05vdE51bGwoKSAmJiBl
bmRPZkxpbmVQb3NpdGlvbi5pc05vdE51bGwoKSkKKyAgICAgICAgbGluZVN0cmluZyA9IHBsYWlu
VGV4dChtYWtlUmFuZ2Uoc3RhcnRPZkxpbmVQb3NpdGlvbiwgZW5kT2ZMaW5lUG9zaXRpb24pLmdl
dCgpKTsKKyAgICAKICAgICBpZiAobGluZVN0cmluZy5pc0VtcHR5KCkpCiAgICAgICAgIHN0YXJ0
UG9zaXRpb24gPSBwcmV2aW91c1Zpc2libGVQb3M7CiAgICAgZWxzZQo=
</data>
<flag name="review"
          id="12931"
          type_id="1"
          status="+"
          setter="bdakin"
    />
          </attachment>
          <attachment
              isobsolete="0"
              ispatch="1"
              isprivate="0"
          >
            <attachid>26987</attachid>
            <date>2009-01-23 16:23:47 -0800</date>
            <delta_ts>2009-01-23 17:18:02 -0800</delta_ts>
            <desc>new patch based on review</desc>
            <filename>patch.txt</filename>
            <type>text/plain</type>
            <size>3207</size>
            <attacher name="chris fleizach">cfleizach</attacher>
            
              <data encoding="base64">SW5kZXg6IFdlYkNvcmUvQ2hhbmdlTG9nCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIFdlYkNvcmUvQ2hhbmdlTG9n
CShyZXZpc2lvbiA0MDE5NikKKysrIFdlYkNvcmUvQ2hhbmdlTG9nCSh3b3JraW5nIGNvcHkpCkBA
IC0xLDMgKzEsMTggQEAKKzIwMDktMDEtMjMgIENocmlzIEZsZWl6YWNoICA8Y2ZsZWl6YWNoQGFw
cGxlLmNvbT4KKworICAgICAgICBSZXZpZXdlZCBieSBOT0JPRFkgKE9PUFMhKS4KKworICAgICAg
ICBCdWcgMjM1MDk6IENyYXNoIGF0IC1bV2ViQ29yZUFYT2JqZWN0IGRvQVhOZXh0U2VudGVuY2VF
bmRUZXh0TWFya2VyRm9yVGV4dE1hcmtlcjpdCisgICAgICAgIGh0dHBzOi8vYnVncy53ZWJraXQu
b3JnL3Nob3dfYnVnLmNnaT9pZD0yMzUwOQorICAKKyAgICAgICAgQWRkIG51bGwgY2hlY2tpbmcg
aW4gbWFrZVJhbmdlIGluc3RlYWQgb2YgQVggY29kZQorCisgICAgICAgICogZWRpdGluZy9WaXNp
YmxlUG9zaXRpb24uY3BwOgorICAgICAgICAoV2ViQ29yZTo6bWFrZVJhbmdlKToKKyAgICAgICAg
KiBwYWdlL0FjY2Vzc2liaWxpdHlPYmplY3QuY3BwOgorICAgICAgICAoV2ViQ29yZTo6QWNjZXNz
aWJpbGl0eU9iamVjdDo6bmV4dFNlbnRlbmNlRW5kUG9zaXRpb24pOgorICAgICAgICAoV2ViQ29y
ZTo6QWNjZXNzaWJpbGl0eU9iamVjdDo6cHJldmlvdXNTZW50ZW5jZVN0YXJ0UG9zaXRpb24pOgor
CiAyMDA5LTAxLTIzICBLZXZpbiBPbGxpdmllciAgPGtldmlub0B0aGVvbGxpdmllcnMuY29tPgog
CiAgICAgICAgIEJ1aWxkIGZpeGVzIGZvciByZWNlbnQgY2hhbmdlcy4KSW5kZXg6IFdlYkNvcmUv
ZWRpdGluZy9WaXNpYmxlUG9zaXRpb24uY3BwCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIFdlYkNvcmUvZWRpdGlu
Zy9WaXNpYmxlUG9zaXRpb24uY3BwCShyZXZpc2lvbiA0MDE5MCkKKysrIFdlYkNvcmUvZWRpdGlu
Zy9WaXNpYmxlUG9zaXRpb24uY3BwCSh3b3JraW5nIGNvcHkpCkBAIC01OTMsNiArNTkzLDkgQEAg
dm9pZCBWaXNpYmxlUG9zaXRpb246OnNob3dUcmVlRm9yVGhpcygpIAogCiBQYXNzUmVmUHRyPFJh
bmdlPiBtYWtlUmFuZ2UoY29uc3QgVmlzaWJsZVBvc2l0aW9uICZzdGFydCwgY29uc3QgVmlzaWJs
ZVBvc2l0aW9uICZlbmQpCiB7CisgICAgaWYgKHN0YXJ0LmlzTnVsbCgpIHx8IGVuZC5pc051bGwo
KSkKKyAgICAgICAgcmV0dXJuIDA7CisgICAgCiAgICAgUG9zaXRpb24gcyA9IHJhbmdlQ29tcGxp
YW50RXF1aXZhbGVudChzdGFydCk7CiAgICAgUG9zaXRpb24gZSA9IHJhbmdlQ29tcGxpYW50RXF1
aXZhbGVudChlbmQpOwogICAgIHJldHVybiBSYW5nZTo6Y3JlYXRlKHMubm9kZSgpLT5kb2N1bWVu
dCgpLCBzLm5vZGUoKSwgcy5vZmZzZXQoKSwgZS5ub2RlKCksIGUub2Zmc2V0KCkpOwpJbmRleDog
V2ViQ29yZS9wYWdlL0FjY2Vzc2liaWxpdHlPYmplY3QuY3BwCj09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIFdlYkNv
cmUvcGFnZS9BY2Nlc3NpYmlsaXR5T2JqZWN0LmNwcAkocmV2aXNpb24gNDAxOTEpCisrKyBXZWJD
b3JlL3BhZ2UvQWNjZXNzaWJpbGl0eU9iamVjdC5jcHAJKHdvcmtpbmcgY29weSkKQEAgLTczOSwx
MyArNzM5LDggQEAgVmlzaWJsZVBvc2l0aW9uIEFjY2Vzc2liaWxpdHlPYmplY3Q6Om5leAogICAg
IC8vIGFuIGVtcHR5IGxpbmUgaXMgY29uc2lkZXJlZCBhIHNlbnRlbmNlLiBJZiBpdCdzIHNraXBw
ZWQsIHRoZW4gdGhlIHNlbnRlbmNlIHBhcnNlciB3aWxsIG5vdAogICAgIC8vIHNlZSB0aGlzIGVt
cHR5IGxpbmUuICBJbnN0ZWFkLCByZXR1cm4gdGhlIGVuZCBwb3NpdGlvbiBvZiB0aGUgZW1wdHkg
bGluZS4KICAgICBWaXNpYmxlUG9zaXRpb24gZW5kUG9zaXRpb247Ci0gICAgVmlzaWJsZVBvc2l0
aW9uIHN0YXJ0T2ZMaW5lUG9zaXRpb24gPSBzdGFydE9mTGluZShuZXh0VmlzaWJsZVBvcyk7Ci0g
ICAgVmlzaWJsZVBvc2l0aW9uIGVuZE9mTGluZVBvc2l0aW9uID0gZW5kT2ZMaW5lKG5leHRWaXNp
YmxlUG9zKTsKLQotICAgIFN0cmluZyBsaW5lU3RyaW5nOwotICAgIGlmIChzdGFydE9mTGluZVBv
c2l0aW9uLmlzTm90TnVsbCgpICYmIGVuZE9mTGluZVBvc2l0aW9uLmlzTm90TnVsbCgpKQotICAg
ICAgICBsaW5lU3RyaW5nID0gcGxhaW5UZXh0KG1ha2VSYW5nZShzdGFydE9mTGluZVBvc2l0aW9u
LCBlbmRPZkxpbmVQb3NpdGlvbikuZ2V0KCkpOwotCisgICAgCisgICAgU3RyaW5nIGxpbmVTdHJp
bmcgPSBwbGFpblRleHQobWFrZVJhbmdlKHN0YXJ0T2ZMaW5lKG5leHRWaXNpYmxlUG9zKSwgZW5k
T2ZMaW5lKG5leHRWaXNpYmxlUG9zKSkuZ2V0KCkpOwogICAgIGlmIChsaW5lU3RyaW5nLmlzRW1w
dHkoKSkKICAgICAgICAgZW5kUG9zaXRpb24gPSBuZXh0VmlzaWJsZVBvczsKICAgICBlbHNlCkBA
IC03NjgsMTMgKzc2Myw4IEBAIFZpc2libGVQb3NpdGlvbiBBY2Nlc3NpYmlsaXR5T2JqZWN0Ojpw
cmUKIAogICAgIC8vIHRyZWF0IGVtcHR5IGxpbmUgYXMgYSBzZXBhcmF0ZSBzZW50ZW5jZS4KICAg
ICBWaXNpYmxlUG9zaXRpb24gc3RhcnRQb3NpdGlvbjsKLSAgICBWaXNpYmxlUG9zaXRpb24gc3Rh
cnRPZkxpbmVQb3NpdGlvbiA9IHN0YXJ0T2ZMaW5lKHByZXZpb3VzVmlzaWJsZVBvcyk7Ci0gICAg
VmlzaWJsZVBvc2l0aW9uIGVuZE9mTGluZVBvc2l0aW9uID0gZW5kT2ZMaW5lKHByZXZpb3VzVmlz
aWJsZVBvcyk7Ci0gICAgCi0gICAgU3RyaW5nIGxpbmVTdHJpbmc7Ci0gICAgaWYgKHN0YXJ0T2ZM
aW5lUG9zaXRpb24uaXNOb3ROdWxsKCkgJiYgZW5kT2ZMaW5lUG9zaXRpb24uaXNOb3ROdWxsKCkp
Ci0gICAgICAgIGxpbmVTdHJpbmcgPSBwbGFpblRleHQobWFrZVJhbmdlKHN0YXJ0T2ZMaW5lUG9z
aXRpb24sIGVuZE9mTGluZVBvc2l0aW9uKS5nZXQoKSk7CiAgICAgCisgICAgU3RyaW5nIGxpbmVT
dHJpbmcgPSBwbGFpblRleHQobWFrZVJhbmdlKHN0YXJ0T2ZMaW5lKHByZXZpb3VzVmlzaWJsZVBv
cyksIGVuZE9mTGluZShwcmV2aW91c1Zpc2libGVQb3MpKS5nZXQoKSk7CiAgICAgaWYgKGxpbmVT
dHJpbmcuaXNFbXB0eSgpKQogICAgICAgICBzdGFydFBvc2l0aW9uID0gcHJldmlvdXNWaXNpYmxl
UG9zOwogICAgIGVsc2UK
</data>
<flag name="review"
          id="12935"
          type_id="1"
          status="+"
          setter="darin"
    />
          </attachment>
      

    </bug>

</bugzilla>