<?xml version="1.0" encoding="UTF-8" standalone="yes" ?>
<!DOCTYPE bugzilla SYSTEM "https://bugs.webkit.org/page.cgi?id=bugzilla.dtd">

<bugzilla version="5.0.4.1"
          urlbase="https://bugs.webkit.org/"
          
          maintainer="admin@webkit.org"
>

    <bug>
          <bug_id>27854</bug_id>
          
          <creation_ts>2009-07-30 13:46:20 -0700</creation_ts>
          <short_desc>crash at WebCore::AXObjectCache::notificationPostTimerFired</short_desc>
          <delta_ts>2009-07-30 14:51:08 -0700</delta_ts>
          <reporter_accessible>1</reporter_accessible>
          <cclist_accessible>1</cclist_accessible>
          <classification_id>1</classification_id>
          <classification>Unclassified</classification>
          <product>WebKit</product>
          <component>Accessibility</component>
          <version>528+ (Nightly build)</version>
          <rep_platform>PC</rep_platform>
          <op_sys>OS X 10.5</op_sys>
          <bug_status>RESOLVED</bug_status>
          <resolution>FIXED</resolution>
          
          
          <bug_file_loc></bug_file_loc>
          <status_whiteboard></status_whiteboard>
          <keywords></keywords>
          <priority>P2</priority>
          <bug_severity>Normal</bug_severity>
          <target_milestone>---</target_milestone>
          
          
          <everconfirmed>1</everconfirmed>
          <reporter name="chris fleizach">cfleizach</reporter>
          <assigned_to name="chris fleizach">cfleizach</assigned_to>
          
          

      

      

      

          <comment_sort_order>oldest_to_newest</comment_sort_order>  
          <long_desc isprivate="0" >
    <commentid>135990</commentid>
    <comment_count>0</comment_count>
    <who name="chris fleizach">cfleizach</who>
    <bug_when>2009-07-30 13:46:20 -0700</bug_when>
    <thetext>accessibility related crash. the accessibility object is not outliving the timer notification</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>135999</commentid>
    <comment_count>1</comment_count>
      <attachid>33834</attachid>
    <who name="chris fleizach">cfleizach</who>
    <bug_when>2009-07-30 14:02:12 -0700</bug_when>
    <thetext>Created attachment 33834
patch</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>136000</commentid>
    <comment_count>2</comment_count>
    <who name="chris fleizach">cfleizach</who>
    <bug_when>2009-07-30 14:02:39 -0700</bug_when>
    <thetext>here the crash bt

          53 com.apple.AppKit:  NSAccessibilityPostNotification + 28
            53 com.apple.WebCore:  WebCore::AXObjectCache::notificationPostTimerFired + 94
              53 com.apple.WebCore:  WebCore::Timer&lt;WebCore::AXObjectCache&gt;::fired + 72
                53 com.apple.WebCore:  WebCore::ThreadTimers::fireTimers + 78
                  53 com.apple.WebCore:  WebCore::ThreadTimers::sharedTimerFiredInternal + 106
                    53 com.apple.WebCore:  WebCore::ThreadTimers::sharedTimerFired + 22
                      53 com.apple.WebCore:  WebCore::timerFired + 63</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>136002</commentid>
    <comment_count>3</comment_count>
    <who name="chris fleizach">cfleizach</who>
    <bug_when>2009-07-30 14:03:14 -0700</bug_when>
    <thetext>i was not able to reproduce this crash, but the backtrace is pretty clear. accessibility objects are being released before the timer can fire and the notification can be posted</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>136003</commentid>
    <comment_count>4</comment_count>
    <who name="chris fleizach">cfleizach</who>
    <bug_when>2009-07-30 14:03:44 -0700</bug_when>
    <thetext>so there&apos;s no layout test, since i could not repro</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>136026</commentid>
    <comment_count>5</comment_count>
    <who name="chris fleizach">cfleizach</who>
    <bug_when>2009-07-30 14:51:08 -0700</bug_when>
    <thetext>http://trac.webkit.org/changeset/46604</thetext>
  </long_desc>
      
          <attachment
              isobsolete="0"
              ispatch="1"
              isprivate="0"
          >
            <attachid>33834</attachid>
            <date>2009-07-30 14:02:12 -0700</date>
            <delta_ts>2009-07-30 14:47:11 -0700</delta_ts>
            <desc>patch</desc>
            <filename>patch.txt</filename>
            <type>text/plain</type>
            <size>2584</size>
            <attacher name="chris fleizach">cfleizach</attacher>
            
              <data encoding="base64">SW5kZXg6IFdlYkNvcmUvQ2hhbmdlTG9nCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIFdlYkNvcmUvQ2hhbmdlTG9n
CShyZXZpc2lvbiA0NjU5OCkKKysrIFdlYkNvcmUvQ2hhbmdlTG9nCSh3b3JraW5nIGNvcHkpCkBA
IC0xLDMgKzEsMTggQEAKKzIwMDktMDctMzAgIENocmlzIEZsZWl6YWNoICA8Y2ZsZWl6YWNoQGFw
cGxlLmNvbT4KKworICAgICAgICBSZXZpZXdlZCBieSBOT0JPRFkgKE9PUFMhKS4KKworICAgICAg
ICBCdWcgMjc4NTQgLSBjcmFzaCBhdCBXZWJDb3JlOjpBWE9iamVjdENhY2hlOjpub3RpZmljYXRp
b25Qb3N0VGltZXJGaXJlZAorICAgICAgICBodHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1
Zy5jZ2k/aWQ9Mjc4NTQKKworICAgICAgICBBY2Nlc3NpYmlsaXR5T2JqZWN0cyBuZWVkIHRvIGJl
IHJldGFpbmVkIHdoaWxlIHdhaXRpbmcgdG8gZmlyZSB0aGVpciBub3RpZmljYXRpb25zLCBvdGhl
cndpc2UKKyAgICAgICAgdGhleSBjYW4gZGlzYXBwZWFyIGFuZCB0aGVuIGxlYWQgdG8gY3Jhc2hl
cy4KKyAgICAgICAKKyAgICAgICAgKiBhY2Nlc3NpYmlsaXR5L0FYT2JqZWN0Q2FjaGUuY3BwOgor
ICAgICAgICAoV2ViQ29yZTo6QVhPYmplY3RDYWNoZTo6bm90aWZpY2F0aW9uUG9zdFRpbWVyRmly
ZWQpOgorICAgICAgICAoV2ViQ29yZTo6QVhPYmplY3RDYWNoZTo6cG9zdE5vdGlmaWNhdGlvbik6
CisgICAgICAgICogYWNjZXNzaWJpbGl0eS9BWE9iamVjdENhY2hlLmg6CisKID09PSBFbmQgbWVy
Z2Ugb2Ygbml0cm8tZXh0cmVtZSBicmFuY2ggMjAwOS0wNy0zMCA9PT0KIAogMjAwOS0wNS0xMSAg
R2VvZmZyZXkgR2FyZW4gIDxnZ2FyZW5AYXBwbGUuY29tPgpJbmRleDogV2ViQ29yZS9hY2Nlc3Np
YmlsaXR5L0FYT2JqZWN0Q2FjaGUuY3BwCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIFdlYkNvcmUvYWNjZXNzaWJp
bGl0eS9BWE9iamVjdENhY2hlLmNwcAkocmV2aXNpb24gNDY1OTYpCisrKyBXZWJDb3JlL2FjY2Vz
c2liaWxpdHkvQVhPYmplY3RDYWNoZS5jcHAJKHdvcmtpbmcgY29weSkKQEAgLTI2MSw3ICsyNjEs
NyBAQCB2b2lkIEFYT2JqZWN0Q2FjaGU6Om5vdGlmaWNhdGlvblBvc3RUaW1lCiAKICAgICB1bnNp
Z25lZCBpID0gMCwgY291bnQgPSBtX25vdGlmaWNhdGlvbnNUb1Bvc3Quc2l6ZSgpOwogICAgIGZv
ciAoaSA9IDA7IGkgPCBjb3VudDsgKytpKSB7Ci0gICAgICAgIEFjY2Vzc2liaWxpdHlPYmplY3Qq
IG9iaiA9IG1fbm90aWZpY2F0aW9uc1RvUG9zdFtpXS5maXJzdDsKKyAgICAgICAgQWNjZXNzaWJp
bGl0eU9iamVjdCogb2JqID0gbV9ub3RpZmljYXRpb25zVG9Qb3N0W2ldLmZpcnN0LmdldCgpOwog
I2lmbmRlZiBOREVCVUcKICAgICAgICAgLy8gTWFrZSBzdXJlIG5vbmUgb2YgdGhlIHJlbmRlciB2
aWV3cyBhcmUgaW4gdGhlIHByb2Nlc3Mgb2YgYmVpbmcgbGF5ZWQgb3V0LgogICAgICAgICAvLyBO
b3RpZmljYXRpb25zIHNob3VsZCBvbmx5IGJlIHNlbnQgYWZ0ZXIgdGhlIHJlbmRlcmVyIGhhcyBm
aW5pc2hlZApAQCAtMzA4LDcgKzMwOCw3IEBAIHZvaWQgQVhPYmplY3RDYWNoZTo6cG9zdE5vdGlm
aWNhdGlvbihSZW4KICAgICBpZiAoIW9iaikKICAgICAgICAgcmV0dXJuOwogCi0gICAgbV9ub3Rp
ZmljYXRpb25zVG9Qb3N0LmFwcGVuZChtYWtlX3BhaXIob2JqLmdldCgpLCBtZXNzYWdlKSk7Cisg
ICAgbV9ub3RpZmljYXRpb25zVG9Qb3N0LmFwcGVuZChtYWtlX3BhaXIob2JqLCBtZXNzYWdlKSk7
CiAgICAgaWYgKCFtX25vdGlmaWNhdGlvblBvc3RUaW1lci5pc0FjdGl2ZSgpKQogICAgICAgICBt
X25vdGlmaWNhdGlvblBvc3RUaW1lci5zdGFydE9uZVNob3QoMCk7CiB9CkluZGV4OiBXZWJDb3Jl
L2FjY2Vzc2liaWxpdHkvQVhPYmplY3RDYWNoZS5oCj09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIFdlYkNvcmUvYWNj
ZXNzaWJpbGl0eS9BWE9iamVjdENhY2hlLmgJKHJldmlzaW9uIDQ2NTk2KQorKysgV2ViQ29yZS9h
Y2Nlc3NpYmlsaXR5L0FYT2JqZWN0Q2FjaGUuaAkod29ya2luZyBjb3B5KQpAQCAtMTA4LDcgKzEw
OCw3IEBAIG5hbWVzcGFjZSBXZWJDb3JlIHsKICAgICAgICAgSGFzaFNldDxBWElEPiBtX2lkc0lu
VXNlOwogICAgICAgICAKICAgICAgICAgVGltZXI8QVhPYmplY3RDYWNoZT4gbV9ub3RpZmljYXRp
b25Qb3N0VGltZXI7Ci0gICAgICAgIFZlY3RvcjxwYWlyPEFjY2Vzc2liaWxpdHlPYmplY3QqLCBj
b25zdCBTdHJpbmc+ID4gbV9ub3RpZmljYXRpb25zVG9Qb3N0OworICAgICAgICBWZWN0b3I8cGFp
cjxSZWZQdHI8QWNjZXNzaWJpbGl0eU9iamVjdD4sIGNvbnN0IFN0cmluZz4gPiBtX25vdGlmaWNh
dGlvbnNUb1Bvc3Q7CiAgICAgICAgIHZvaWQgbm90aWZpY2F0aW9uUG9zdFRpbWVyRmlyZWQoVGlt
ZXI8QVhPYmplY3RDYWNoZT4qKTsKICAgICAgICAgCiAgICAgICAgIEFYSUQgZ2V0QVhJRChBY2Nl
c3NpYmlsaXR5T2JqZWN0Kik7Cg==
</data>
<flag name="review"
          id="18033"
          type_id="1"
          status="+"
          setter="darin"
    />
          </attachment>
      

    </bug>

</bugzilla>