42652 2010-07-20 10:45:17 -0700 CrashTracer: [USER] 300 crashes in Safari at com.apple.WebCore: WebCore::AccessibilityTable::isTableExposableThroughAccessibility + 573 2010-07-20 14:35:40 -0700 1 1 1 Unclassified WebKit Accessibility 528+ (Nightly build) PC OS X 10.5 RESOLVED FIXED InRadar P2 Normal --- 1 cfleizach cfleizach bdakin oldest_to_newest 253815 0 cfleizach 2010-07-20 10:45:17 -0700 55 com.apple.WebCore: WebCore::AccessibilityTable::AccessibilityTable + 94 <== 55 com.apple.WebCore: WebCore::AccessibilityTable::create + 50 55 com.apple.WebCore: WebCore::AXObjectCache::getOrCreate + 1066 28 com.apple.WebCore: WebCore::AccessibilityTableCell::isTableCell const + 13 | 28 com.apple.WebCore: WebCore::AccessibilityTableCell::roleValue const + 21 | 28 com.apple.WebCore: WebCore::AccessibilityRenderObject::ariaLiveRegionStatus const + 96 | 28 com.apple.WebCore: WebCore::AccessibilityObject::supportsARIALiveRegion const + 18 | 28 com.apple.WebCore: WebCore::AccessibilityRenderObject::contentChanged + 72 | 28 com.apple.WebCore: WebCore::StyledElement::attributeChanged + 331 | 28 com.apple.WebCore: WebCore::NamedNodeMap::addAttribute + 119 | 26 com.apple.WebCore: WebCore::Element::setAttribute + 594 | | 26 com.apple.WebCore: WebCore::Element::setAttribute + 17 | | 26 com.apple.WebCore: WebCore::setJSHTMLElementTitle + 102 | | 26 com.apple.WebCore: WebCore::JSHTMLElement::put + 186 | | 26 com.apple.WebCore: WebCore::JSHTMLTableCellElement::put + 133 253816 1 cfleizach 2010-07-20 10:46:49 -0700 this can happen when you remove a row from a table, then add a row, then modify an attribute on the new row. That will cause the AccessibilityTable to see if it should be exposed as a table. That in turn will look at its grid of cells, accessing the row that was removed. the solution is that we cannot use getOrCreate in contentChanged(). we can only access AX elements already created. 253854 2 cfleizach 2010-07-20 12:19:57 -0700 Actually a better solution is that the table cell should not getOrCreate its parent. it should only get it's parent. There's no real user cases where a table cell will be created in AX, before its AXTable is created 253856 3 62099 cfleizach 2010-07-20 12:24:05 -0700 Created attachment 62099 Patch 253906 4 62099 bdakin 2010-07-20 14:09:07 -0700 Comment on attachment 62099 Patch r=me! 253922 5 cfleizach 2010-07-20 14:35:40 -0700 http://trac.webkit.org/changeset/63774 62099 2010-07-20 12:24:05 -0700 2010-07-20 14:09:07 -0700 Patch bug-42652-20100720122403.patch text/plain 5475 cfleizach SW5kZXg6IFdlYkNvcmUvQ2hhbmdlTG9nCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIFdlYkNvcmUvQ2hhbmdlTG9n CShyZXZpc2lvbiA2Mzc2MikKKysrIFdlYkNvcmUvQ2hhbmdlTG9nCSh3b3JraW5nIGNvcHkpCkBA IC0xLDMgKzEsMjAgQEAKKzIwMTAtMDctMjAgIENocmlzIEZsZWl6YWNoICA8Y2ZsZWl6YWNoQGFw cGxlLmNvbT4KKworICAgICAgICBSZXZpZXdlZCBieSBOT0JPRFkgKE9PUFMhKS4KKworICAgICAg ICBDcmFzaFRyYWNlcjogW1VTRVJdIDMwMCBjcmFzaGVzIGluIFNhZmFyaSBhdCBjb20uYXBwbGUu V2ViQ29yZTogV2ViQ29yZTo6QWNjZXNzaWJpbGl0eVRhYmxlOjppc1RhYmxlRXhwb3NhYmxlVGhy b3VnaEFjY2Vzc2liaWxpdHkgKyA1NzMKKyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcv c2hvd19idWcuY2dpP2lkPTQyNjUyCisKKyAgICAgICAgV2hlbiBhIHRhYmxlIGNlbGwgYWNjZXNz ZXMgaXRzIHBhcmVudCB0YWJsZSwgd2Ugc2hvdWxkIG5vdCB1c2UgZ2V0T3JDcmVhdGUsIGJlY2F1 c2UgY3JlYXRpbmcgYW4gQVhUYWJsZSBpbnNwZWN0cyBpdHMgcmVuZGVyIHRyZWUgc3RhdGUKKyAg ICAgICAgd2hpY2ggbWF5IGJlIG91dCBvZiBkYXRlLCBsZWFkaW5nIHRvIGEgY3Jhc2guCisgICAg ICAgIEJ5IHVzaW5nIG9ubHkgZ2V0KCksIGl0IGltcGxpZXMgdGhhdCB0aGUgQVhUYWJsZSBtdXN0 IGJlIGNyZWF0ZWQgYmVmb3JlIEFYVGFibGVDZWxscy4gVGhpcyBzaG91bGQKKyAgICAgICAgYWx3 YXlzIGJlIHRoZSBjYXNlIHdoZW4gQVQgY2xpZW50cyBhY2Nlc3MgYSB0YWJsZS4KKworICAgICAg ICBUZXN0OiBhY2Nlc3NpYmlsaXR5L3VwZGF0aW5nLWF0dHJpYnV0ZS1pbi10YWJsZS1jYXVzZXMt Y3Jhc2guaHRtbAorCisgICAgICAgICogYWNjZXNzaWJpbGl0eS9BY2Nlc3NpYmlsaXR5VGFibGVD ZWxsLmNwcDoKKyAgICAgICAgKFdlYkNvcmU6OkFjY2Vzc2liaWxpdHlUYWJsZUNlbGw6OnBhcmVu dFRhYmxlKToKKwogMjAxMC0wNy0yMCAgQWRhbSBCYXJ0aCAgPGFiYXJ0aEB3ZWJraXQub3JnPgog CiAgICAgICAgIFJldmlld2VkIGJ5IEVyaWMgU2VpZGVsLgpJbmRleDogV2ViQ29yZS9hY2Nlc3Np YmlsaXR5L0FjY2Vzc2liaWxpdHlUYWJsZUNlbGwuY3BwCj09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIFdlYkNvcmUv YWNjZXNzaWJpbGl0eS9BY2Nlc3NpYmlsaXR5VGFibGVDZWxsLmNwcAkocmV2aXNpb24gNjM3NDgp CisrKyBXZWJDb3JlL2FjY2Vzc2liaWxpdHkvQWNjZXNzaWJpbGl0eVRhYmxlQ2VsbC5jcHAJKHdv cmtpbmcgY29weSkKQEAgLTczLDcgKzczLDEyIEBAIEFjY2Vzc2liaWxpdHlPYmplY3QqIEFjY2Vz c2liaWxpdHlUYWJsZUMKICAgICBpZiAoIW1fcmVuZGVyZXIgfHwgIW1fcmVuZGVyZXItPmlzVGFi bGVDZWxsKCkpCiAgICAgICAgIHJldHVybiAwOwogICAgIAotICAgIHJldHVybiBheE9iamVjdENh Y2hlKCktPmdldE9yQ3JlYXRlKHRvUmVuZGVyVGFibGVDZWxsKG1fcmVuZGVyZXIpLT50YWJsZSgp KTsKKyAgICAvLyBEbyBub3QgdXNlIGdldE9yQ3JlYXRlLiBwYXJlbnRUYWJsZSgpIGNhbiBiZSBj YWxsZWQgd2hpbGUgdGhlIHJlbmRlciB0cmVlIGlzIGJlaW5nIG1vZGlmaWVkIAorICAgIC8vIGJ5 IGphdmFzY3JpcHQsIGFuZCBjcmVhdGluZyBhIHRhYmxlIGVsZW1lbnQgbWF5IHRyeSB0byBhY2Nl c3MgdGhlIHJlbmRlciB0cmVlIHdoaWxlIGluIGEgYmFkIHN0YXRlLgorICAgIC8vIEJ5IHVzaW5n IG9ubHkgZ2V0KCkgaW1wbGllcyB0aGF0IHRoZSBBWFRhYmxlIG11c3QgYmUgY3JlYXRlZCBiZWZv cmUgQVhUYWJsZUNlbGxzLiBUaGlzIHNob3VsZAorICAgIC8vIGFsd2F5cyBiZSB0aGUgY2FzZSB3 aGVuIEFUIGNsaWVudHMgYWNjZXNzIGEgdGFibGUuCisgICAgLy8gaHR0cHM6Ly9idWdzLndlYmtp dC5vcmcvc2hvd19idWcuY2dpP2lkPTQyNjUyICAgIAorICAgIHJldHVybiBheE9iamVjdENhY2hl KCktPmdldCh0b1JlbmRlclRhYmxlQ2VsbChtX3JlbmRlcmVyKS0+dGFibGUoKSk7CiB9CiAgICAg CiBib29sIEFjY2Vzc2liaWxpdHlUYWJsZUNlbGw6OmlzVGFibGVDZWxsKCkgY29uc3QKSW5kZXg6 IExheW91dFRlc3RzL0NoYW5nZUxvZwo9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBMYXlvdXRUZXN0cy9DaGFuZ2VM b2cJKHJldmlzaW9uIDYzNzYyKQorKysgTGF5b3V0VGVzdHMvQ2hhbmdlTG9nCSh3b3JraW5nIGNv cHkpCkBAIC0xLDMgKzEsMTMgQEAKKzIwMTAtMDctMjAgIENocmlzIEZsZWl6YWNoICA8Y2ZsZWl6 YWNoQGFwcGxlLmNvbT4KKworICAgICAgICBSZXZpZXdlZCBieSBOT0JPRFkgKE9PUFMhKS4KKwor ICAgICAgICBDcmFzaFRyYWNlcjogW1VTRVJdIDMwMCBjcmFzaGVzIGluIFNhZmFyaSBhdCBjb20u YXBwbGUuV2ViQ29yZTogV2ViQ29yZTo6QWNjZXNzaWJpbGl0eVRhYmxlOjppc1RhYmxlRXhwb3Nh YmxlVGhyb3VnaEFjY2Vzc2liaWxpdHkgKyA1NzMKKyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtp dC5vcmcvc2hvd19idWcuY2dpP2lkPTQyNjUyCisKKyAgICAgICAgKiBhY2Nlc3NpYmlsaXR5L3Vw ZGF0aW5nLWF0dHJpYnV0ZS1pbi10YWJsZS1jYXVzZXMtY3Jhc2gtZXhwZWN0ZWQudHh0OiBBZGRl ZC4KKyAgICAgICAgKiBhY2Nlc3NpYmlsaXR5L3VwZGF0aW5nLWF0dHJpYnV0ZS1pbi10YWJsZS1j YXVzZXMtY3Jhc2guaHRtbDogQWRkZWQuCisKIDIwMTAtMDctMjAgIFN0ZXBoZW4gV2hpdGUgIDxz ZW5vcmJsYW5jb0BjaHJvbWl1bS5vcmc+CiAKICAgICAgICAgVW5yZXZpZXdlZDsgcGl4ZWwgdGVz dCByZXN1bHRzIGZpeC4KSW5kZXg6IExheW91dFRlc3RzL2FjY2Vzc2liaWxpdHkvdXBkYXRpbmct YXR0cmlidXRlLWluLXRhYmxlLWNhdXNlcy1jcmFzaC1leHBlY3RlZC50eHQKPT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQot LS0gTGF5b3V0VGVzdHMvYWNjZXNzaWJpbGl0eS91cGRhdGluZy1hdHRyaWJ1dGUtaW4tdGFibGUt Y2F1c2VzLWNyYXNoLWV4cGVjdGVkLnR4dAkocmV2aXNpb24gMCkKKysrIExheW91dFRlc3RzL2Fj Y2Vzc2liaWxpdHkvdXBkYXRpbmctYXR0cmlidXRlLWluLXRhYmxlLWNhdXNlcy1jcmFzaC1leHBl Y3RlZC50eHQJKHJldmlzaW9uIDApCkBAIC0wLDAgKzEsMTEgQEAKKzEJMgorYXNkZgorVGhpcyB0 ZXN0cyBmb3IgYSBjcmFzaCB0aGF0IGNhbiBvY2N1ciB3aGlsZSBhbHRlcmluZyBhbiBhdHRyaWJ1 dGUgb24gYSB0YWJsZSBjZWxsIGJlY2F1c2UgaXQgYWNjZXNzZXMgdGhlIHRhYmxlIHdoZW4gaXRz IGluIGEgYmFkIHN0YXRlLgorCitPbiBzdWNjZXNzLCB5b3Ugd2lsbCBzZWUgYSBzZXJpZXMgb2Yg IlBBU1MiIG1lc3NhZ2VzLCBmb2xsb3dlZCBieSAiVEVTVCBDT01QTEVURSIuCisKKworUEFTUyBz dWNjZXNzZnVsbHlQYXJzZWQgaXMgdHJ1ZQorCitURVNUIENPTVBMRVRFCisKSW5kZXg6IExheW91 dFRlc3RzL2FjY2Vzc2liaWxpdHkvdXBkYXRpbmctYXR0cmlidXRlLWluLXRhYmxlLWNhdXNlcy1j cmFzaC5odG1sCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT0KLS0tIExheW91dFRlc3RzL2FjY2Vzc2liaWxpdHkvdXBkYXRp bmctYXR0cmlidXRlLWluLXRhYmxlLWNhdXNlcy1jcmFzaC5odG1sCShyZXZpc2lvbiAwKQorKysg TGF5b3V0VGVzdHMvYWNjZXNzaWJpbGl0eS91cGRhdGluZy1hdHRyaWJ1dGUtaW4tdGFibGUtY2F1 c2VzLWNyYXNoLmh0bWwJKHJldmlzaW9uIDApCkBAIC0wLDAgKzEsNDIgQEAKKzwhRE9DVFlQRSBI VE1MIFBVQkxJQyAiLS8vSUVURi8vRFREIEhUTUwvL0VOIj4KKzxodG1sPgorPGhlYWQ+Cis8bGlu ayByZWw9InN0eWxlc2hlZXQiIGhyZWY9Ii4uL2Zhc3QvanMvcmVzb3VyY2VzL2pzLXRlc3Qtc3R5 bGUuY3NzIj4KKzxzY3JpcHQ+CisgICAgdmFyIHN1Y2Nlc3NmdWxseVBhcnNlZCA9IGZhbHNlOwor PC9zY3JpcHQ+Cis8c2NyaXB0IHNyYz0iLi4vZmFzdC9qcy9yZXNvdXJjZXMvanMtdGVzdC1wcmUu anMiPjwvc2NyaXB0PgorPC9oZWFkPgorPGJvZHkgaWQ9ImJvZHkiPgorCis8dGFibGUgaWQ9InRh YmxlIj4KKzx0ciBpZD0icm93Ij48dGQgaWQ9InRhYmxlY2VsbCIgdGFiaW5kZXg9MD4xPC90ZD48 dGQ+MjwvdGQ+PC90cj4KKzx0ciBpZD0icm93MiI+PHRkIGlkPSJ0YWJsZWNlbGwyIiB0YWJpbmRl eD0wPjE8L3RkPjx0ZD4yPC90ZD48L3RyPgorPC90YWJsZT4KKworPHAgaWQ9ImRlc2NyaXB0aW9u Ij48L3A+Cis8ZGl2IGlkPSJjb25zb2xlIj48L2Rpdj4KKworPHNjcmlwdD4KKyAgICBkZXNjcmlw dGlvbigiVGhpcyB0ZXN0cyBmb3IgYSBjcmFzaCB0aGF0IGNhbiBvY2N1ciB3aGlsZSBhbHRlcmlu ZyBhbiBhdHRyaWJ1dGUgb24gYSB0YWJsZSBjZWxsIGJlY2F1c2UgaXQgYWNjZXNzZXMgdGhlIHRh YmxlIHdoZW4gaXRzIGluIGEgYmFkIHN0YXRlLiIpOworCisgICAgaWYgKHdpbmRvdy5hY2Nlc3Np YmlsaXR5Q29udHJvbGxlcikgeworICAgICAgICBkb2N1bWVudC5nZXRFbGVtZW50QnlJZCgiYm9k eSIpLmZvY3VzKCk7CisgICAgICAgIHZhciBib2R5ID0gYWNjZXNzaWJpbGl0eUNvbnRyb2xsZXIu Zm9jdXNlZEVsZW1lbnQ7CisgICAgICAgIHZhciB0ciA9IGRvY3VtZW50LmNyZWF0ZUVsZW1lbnQo InRyIik7CisgICAgICAgIHZhciB0ZCA9IGRvY3VtZW50LmNyZWF0ZUVsZW1lbnQoInRkIik7Cisg ICAgICAgIHRkLmFwcGVuZENoaWxkKGRvY3VtZW50LmNyZWF0ZVRleHROb2RlKCJhc2RmIikpOwor ICAgICAgICB0ci5hcHBlbmRDaGlsZCh0ZCk7CisKKyAgICAgICAgLy8gVG8gcmVwcm9kdWNlLCB3 ZSBuZWVkIHRvIHJlbW92ZSBhIHJvdyBhbmQgcmVwbGFjZSB3aXRoIGFub3RoZXIgcm93LCB0aGVu IHNldCBhbiBhdHRyaWJ1dGUgaW4gdGhlIG1lYW50aW1lLgorICAgICAgICBkb2N1bWVudC5nZXRF bGVtZW50QnlJZCgidGFibGUiKS5nZXRFbGVtZW50c0J5VGFnTmFtZSgiVEJPRFkiKVswXS5yZW1v dmVDaGlsZChkb2N1bWVudC5nZXRFbGVtZW50QnlJZCgicm93MiIpKTsKKyAgICAgICAgZG9jdW1l bnQuZ2V0RWxlbWVudEJ5SWQoInRhYmxlIikuZ2V0RWxlbWVudHNCeVRhZ05hbWUoIlRCT0RZIilb MF0uYXBwZW5kQ2hpbGQodHIpOworICAgICAgICBkb2N1bWVudC5nZXRFbGVtZW50QnlJZCgidGFi bGVjZWxsIikuc2V0QXR0cmlidXRlKCJ0aXRsZSIsICJ0ZXN0Iik7CisgICAgfQorCisgICAgc3Vj Y2Vzc2Z1bGx5UGFyc2VkID0gdHJ1ZTsKKzwvc2NyaXB0PgorCis8c2NyaXB0IHNyYz0iLi4vZmFz dC9qcy9yZXNvdXJjZXMvanMtdGVzdC1wb3N0LmpzIj48L3NjcmlwdD4KKzwvYm9keT4KKzwvaHRt bD4K