95740 2012-09-04 06:04:05 -0700 [GTK] Crash in AccessibilityObject::accessibilityPlatformIncludesObject() 2012-09-04 12:23:23 -0700 1 1 1 Unclassified WebKit Accessibility 528+ (Nightly build) Unspecified Unspecified RESOLVED FIXED P2 Major --- 0 jdiggs webkit-unassigned mrobinson webkit.review.bot oldest_to_newest 711039 0 jdiggs 2012-09-04 06:04:05 -0700 Just came across this. Investigating.... Thread 1 (Thread 0x7fffef3249c0 (LWP 2627)): #0 0x00007ffff785a036 in WebCore::AccessibilityObject::accessibilityPlatformIncludesObject() const () from /opt/gnome/lib64/libwebkitgtk-3.0.so.0 #1 0x00007ffff69256d9 in WebCore::AccessibilityMenuListPopup::accessibilityIsIgnored() const () from /opt/gnome/lib64/libwebkitgtk-3.0.so.0 #2 0x00007ffff6926b0e in WebCore::AccessibilityObject::parentObjectUnignored() const () from /opt/gnome/lib64/libwebkitgtk-3.0.so.0 #3 0x00007ffff78644b5 in webkitAccessibleGetIndexInParent(_AtkObject*) () from /opt/gnome/lib64/libwebkitgtk-3.0.so.0 #4 0x00007ffff003b2e8 in impl_GetIndexInParent (bus=<optimized out>, message=0x1850ef0, user_data=0x1b1da30) at accessible-adaptor.c:226 #5 0x00007ffff0039991 in handle_other (pathstr=0x19bc088 "/org/a11y/atspi/accessible/240", member=<optimized out>, iface=0x19bc0c0 "org.a11y.atspi.Accessible", path=0x703f30, message=0x1850ef0, bus=0x19d11d0) at droute.c:538 #6 handle_message (bus=0x19d11d0, message=0x1850ef0, user_data=0x703f30) at droute.c:585 #7 0x00000033b801d685 in ?? () from /lib64/libdbus-1.so.3 #8 0x00000033b800f90d in dbus_connection_dispatch () from /lib64/libdbus-1.so.3 #9 0x00007fffefe10a15 in message_queue_dispatch (source=source@entry=0x1b19df0, callback=<optimized out>, user_data=<optimized out>) at atspi-gmain.c:97 #10 0x00007ffff029e5c5 in g_main_dispatch (context=0x702810) at gmain.c:2715 #11 g_main_context_dispatch (context=context@entry=0x702810) at gmain.c:3219 #12 0x00007ffff029e8f8 in g_main_context_iterate (context=context@entry=0x702810, block=block@entry=1, dispatch=dispatch@entry=1, self=<optimized out>) at gmain.c:3290 #13 0x00007ffff029e9b4 in g_main_context_iteration (context=0x702810, context@entry=0x0, may_block=may_block@entry=1) at gmain.c:3351 #14 0x00007ffff12d7f6c in g_application_run (application=0x839000, argc=argc@entry=1, argv=argv@entry=0x7fffffffd938) at gapplication.c:1607 #15 0x00000000004306c4 in main (argc=1, argv=0x7fffffffd938) at ephy-main.c:499 711085 1 jdiggs 2012-09-04 06:57:32 -0700 Seems we need a sanity check here: --- a/Source/WebCore/accessibility/gtk/AccessibilityObjectAtk.cpp +++ b/Source/WebCore/accessibility/gtk/AccessibilityObjectAtk.cpp @@ -104,7 +104,7 @@ AccessibilityObjectInclusion AccessibilityObject::accessibilityPlatformIncludesO // anonymous blocks which are aria-related to themselves have an aria role, nor // have we encountered instances where the parent of an anonymous block also lacked // an aria role but the grandparent had one. - if (renderer()->isAnonymousBlock() && !parent->renderer()->isBody() + if (renderer() && renderer()->isAnonymousBlock() && !parent->renderer()->isBody() && parent->ariaRoleAttribute() == UnknownRole) return IgnoreObject; My bad. I still need to come up with a layout test that reproduces this scenario. (It's triggered by an AT poking at objects, e.g. looking for the next Heading for structural navigation, and coming across an object that lacks a renderer.) 711093 2 mrobinson 2012-09-04 07:14:14 -0700 (In reply to comment #1) > My bad. > > I still need to come up with a layout test that reproduces this scenario. (It's triggered by an AT poking at objects, e.g. looking for the next Heading for structural navigation, and coming across an object that lacks a renderer.) You can also write a unit test if it would be easier. 711208 3 jdiggs 2012-09-04 10:14:23 -0700 (In reply to comment #2) > (In reply to comment #1) > > > My bad. > > > > I still need to come up with a layout test that reproduces this scenario. (It's triggered by an AT poking at objects, e.g. looking for the next Heading for structural navigation, and coming across an object that lacks a renderer.) > > You can also write a unit test if it would be easier. I thought I had a reliable layout test. Nope. Doesn't crash all the time. Coming up with an automated test that only requires ATK (rather than AT-SPI along with an AT) is proving challenging. Came up with a different test case for the same problem. Will try it and unit-style. But I am reaching the point where I will accept pity too. ;) It's a sanity check which solves a crasher and it could be fixed if only I could come up with a magical test. :-/ Thread 1 (Thread 0x7f8906bf49c0 (LWP 20147)): #0 0x00007f890b81b0a6 in WebCore::AccessibilityObject::accessibilityPlatformIncludesObject() const () from /home/jd/checkout/WebKit/WebKitBuild/Release/.libs/libwebkitgtk-3.0.so.0 #1 0x00007f890a8a0439 in WebCore::AccessibilityMenuListPopup::accessibilityIsIgnored() const () from /home/jd/checkout/WebKit/WebKitBuild/Release/.libs/libwebkitgtk-3.0.so.0 #2 0x00007f890b81e74b in webkitAccessibleHypertextGetNLinks(_AtkHypertext*) () from /home/jd/checkout/WebKit/WebKitBuild/Release/.libs/libwebkitgtk-3.0.so.0 #3 0x00007f88fff2a868 in impl_GetNLinks (bus=<optimized out>, message=0x112ae00, user_data=0x11f3e30) at hypertext-adaptor.c:42 #4 0x00007f88fff248d1 in handle_other (pathstr=0x112b818 "/org/a11y/atspi/accessible/77", member=<optimized out>, iface=0x112b850 "org.a11y.atspi.Hypertext", path=0x100c640, message=0x112ae00, bus=0x1018c00) at droute.c:538 #5 handle_message (bus=0x1018c00, message=0x112ae00, user_data=0x100c640) at droute.c:586 #6 0x00000033b801d685 in ?? () from /lib64/libdbus-1.so.3 #7 0x00000033b800f90d in dbus_connection_dispatch () from /lib64/libdbus-1.so.3 #8 0x00007f88ffcfa735 in message_queue_dispatch (source=source@entry=0x100b030, callback=<optimized out>, user_data=<optimized out>) at atspi-gmain.c:97 #9 0x00007f8906ed4275 in g_main_dispatch (context=0xee00c0) at gmain.c:2539 #10 g_main_context_dispatch (context=context@entry=0xee00c0) at gmain.c:3075 #11 0x00007f8906ed45a8 in g_main_context_iterate (context=0xee00c0, block=block@entry=1, dispatch=dispatch@entry=1, self=<optimized out>) at gmain.c:3146 #12 0x00007f8906ed49a2 in g_main_loop_run (loop=0x10ea460) at gmain.c:3340 #13 0x00007f8908ef1ee5 in gtk_main () at gtkmain.c:1161 #14 0x0000000000403969 in main () 711242 4 jdiggs 2012-09-04 11:02:29 -0700 <laughing insanely, but cheerfully /> Reliably reproducible crasher by adding a check to one of our unit tests! (Patch to follow) Thread 1 (Thread 0x7ffff15d79c0 (LWP 24453)): #0 0x00007ffff71f6056 in WebCore::AccessibilityObject::accessibilityPlatformIncludesObject() const () from /home/jd/checkout/gnome/WebKit/.libs/libwebkitgtk-3.0.so.0 #1 0x00007ffff62c1499 in WebCore::AccessibilityMenuListOption::accessibilityIsIgnored() const () from /home/jd/checkout/gnome/WebKit/.libs/libwebkitgtk-3.0.so.0 #2 0x00007ffff71f96fb in webkitAccessibleHypertextGetNLinks(_AtkHypertext*) () from /home/jd/checkout/gnome/WebKit/.libs/libwebkitgtk-3.0.so.0 #3 0x000000000040b092 in testWebkitAtkComboBox () #4 0x00007ffff1cc9cf5 in test_case_run (tc=0x74f430) at gtestutils.c:1679 #5 g_test_run_suite_internal (suite=suite@entry=0x696520, path=<optimized out>, path@entry=0x7ffff1d3e1be "") at gtestutils.c:1732 #6 0x00007ffff1cc9e76 in g_test_run_suite_internal (suite=suite@entry=0x696540, path=<optimized out>, path@entry=0x7ffff1d3e1be "") at gtestutils.c:1743 #7 0x00007ffff1cc9e76 in g_test_run_suite_internal (suite=suite@entry=0x696620, path=<optimized out>, path@entry=0x7ffff1d3e1be "") at gtestutils.c:1743 #8 0x00007ffff1cca1db in g_test_run_suite (suite=0x696620) at gtestutils.c:1788 #9 0x0000000000402c62 in main () 711256 5 162067 jdiggs 2012-09-04 11:13:56 -0700 Created attachment 162067 Patch 711264 6 162067 mrobinson 2012-09-04 11:18:00 -0700 Comment on attachment 162067 Patch Do you mind also adding this to the list of proposed merges for the 1.10.x series? https://trac.webkit.org/wiki/WebKitGTK/1.10.x 711338 7 162067 webkit.review.bot 2012-09-04 12:23:19 -0700 Comment on attachment 162067 Patch Clearing flags on attachment: 162067 Committed r127483: <http://trac.webkit.org/changeset/127483> 711340 8 webkit.review.bot 2012-09-04 12:23:23 -0700 All reviewed patches have been landed. Closing bug. 162067 2012-09-04 11:13:56 -0700 2012-09-04 12:23:19 -0700 Patch bug-95740-20120904141339.patch text/plain 3531 jdiggs U3VidmVyc2lvbiBSZXZpc2lvbjogMTI3MzcxCmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9D aGFuZ2VMb2cgYi9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cKaW5kZXggM2M3NzUxM2JlMDU0MzEz MzkxNTRmNzcwYzg3ZDg3ZWRjMjlhNzcyMC4uYWU5MzQ0ZjE0MDgwNTk4MGViMTVjMWRjOTdhOWVi N2VmMjViNzA4ZCAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCisrKyBiL1Nv dXJjZS9XZWJDb3JlL0NoYW5nZUxvZwpAQCAtMSwzICsxLDIwIEBACisyMDEyLTA5LTA0ICBKb2Fu bWFyaWUgRGlnZ3MgIDxqZGlnZ3NAaWdhbGlhLmNvbT4KKworICAgICAgICBbR1RLXSBDcmFzaCBp biBBY2Nlc3NpYmlsaXR5T2JqZWN0OjphY2Nlc3NpYmlsaXR5UGxhdGZvcm1JbmNsdWRlc09iamVj dCgpCisgICAgICAgIGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD05NTc0 MAorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgIEFkZGVk IHNhbml0eSBjaGVjayB0byBiZSBzdXJlIHdlIGhhdmUgYSByZW5kZXIgb2JqZWN0IHByaW9yIHRv IHNlZWluZyBpZgorICAgICAgICBzYWlkIG9iamVjdCBpcyBhbiBhbm9ueW1vdXMgYmxvY2suCisK KyAgICAgICAgVGVzdGluZyB2aWEgdW5pdCB0ZXN0IGJlY2F1c2UgYSBub24tZmxha3kgbGF5b3V0 IHRlc3QgY3Jhc2hlciBjb3VsZCBub3QKKyAgICAgICAgYmUgZm91bmQuCisKKyAgICAgICAgKiBh Y2Nlc3NpYmlsaXR5L2d0ay9BY2Nlc3NpYmlsaXR5T2JqZWN0QXRrLmNwcDoKKyAgICAgICAgKFdl YkNvcmU6OkFjY2Vzc2liaWxpdHlPYmplY3Q6OmFjY2Vzc2liaWxpdHlQbGF0Zm9ybUluY2x1ZGVz T2JqZWN0KToKKyAgICAgICAgU2FuaXR5IGNoZWNrIGZvciByZW5kZXIgb2JqZWN0IGFkZGVkLgor CiAyMDEyLTA5LTAxICBEaXJrIFNjaHVsemUgIDxrcml0QHdlYmtpdC5vcmc+CiAKICAgICAgICAg W1F0XSBGaXggdGhlIC0tbWluaW1hbCBidWlsZCBhZnRlciByMTI3MzI3CmRpZmYgLS1naXQgYS9T b3VyY2UvV2ViS2l0L2d0ay9DaGFuZ2VMb2cgYi9Tb3VyY2UvV2ViS2l0L2d0ay9DaGFuZ2VMb2cK aW5kZXggNWUwNDgxYzQ2ZjVjMzIxYWE2Y2UyM2U2NzgxOWE4YWExOTczMjk1Ny4uYTA0YzRmYTk4 ODQ0YmNjN2M3NjEzYjBhNTEzZTA3NDg5MThiODczYiAxMDA2NDQKLS0tIGEvU291cmNlL1dlYktp dC9ndGsvQ2hhbmdlTG9nCisrKyBiL1NvdXJjZS9XZWJLaXQvZ3RrL0NoYW5nZUxvZwpAQCAtMSwz ICsxLDE2IEBACisyMDEyLTA5LTA0ICBKb2FubWFyaWUgRGlnZ3MgIDxqZGlnZ3NAaWdhbGlhLmNv bT4KKworICAgICAgICBbR1RLXSBDcmFzaCBpbiBBY2Nlc3NpYmlsaXR5T2JqZWN0OjphY2Nlc3Np YmlsaXR5UGxhdGZvcm1JbmNsdWRlc09iamVjdCgpCisgICAgICAgIGh0dHBzOi8vYnVncy53ZWJr aXQub3JnL3Nob3dfYnVnLmNnaT9pZD05NTc0MAorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9E WSAoT09QUyEpLgorCisgICAgICAgIFVwZGF0ZWQgdW5pdCB0ZXN0LgorCisgICAgICAgICogdGVz dHMvdGVzdGF0ay5jOgorICAgICAgICAodGVzdFdlYmtpdEF0a0NvbWJvQm94KTogQWRkZWQgY2hl Y2tzIHRoYXQgdGhlIG1lbnUgcG9wdXAgaW4gYSBjb21ibyBib3gKKyAgICAgICAgaGFzIDAgbGlu a3MgYW5kLCBtb3JlIGltcG9ydGFudGx5LCB0aGF0IGNoZWNraW5nIGRvZXNuJ3QgcmVzdWx0IGlu IGEgY3Jhc2guCisKIDIwMTItMDktMDEgIEpvYW5tYXJpZSBEaWdncyAgPGpkaWdnc0BpZ2FsaWEu Y29tPgogCiAgICAgICAgIFtHdGtdIEluY29ycmVjdC91bmV4cGVjdGVkIGNoYXJhY3RlcnMgaW4g dGhlIHRleHQgb2YgY2VydGFpbiBhY2Nlc3NpYmxlcwpkaWZmIC0tZ2l0IGEvU291cmNlL1dlYkNv cmUvYWNjZXNzaWJpbGl0eS9ndGsvQWNjZXNzaWJpbGl0eU9iamVjdEF0ay5jcHAgYi9Tb3VyY2Uv V2ViQ29yZS9hY2Nlc3NpYmlsaXR5L2d0ay9BY2Nlc3NpYmlsaXR5T2JqZWN0QXRrLmNwcAppbmRl eCA3NDhiNGJmOTAzMDdmMTQzNTI5Yzc2NTAyNzBmZjgwMmQ3NTEwMzUyLi4yNGY5YjkzMGQ5Njgw ZWM5NjM3NDMyNWVhYzExNWY1ZWE2ZDg1ZGM5IDEwMDY0NAotLS0gYS9Tb3VyY2UvV2ViQ29yZS9h Y2Nlc3NpYmlsaXR5L2d0ay9BY2Nlc3NpYmlsaXR5T2JqZWN0QXRrLmNwcAorKysgYi9Tb3VyY2Uv V2ViQ29yZS9hY2Nlc3NpYmlsaXR5L2d0ay9BY2Nlc3NpYmlsaXR5T2JqZWN0QXRrLmNwcApAQCAt MTA0LDcgKzEwNCw3IEBAIEFjY2Vzc2liaWxpdHlPYmplY3RJbmNsdXNpb24gQWNjZXNzaWJpbGl0 eU9iamVjdDo6YWNjZXNzaWJpbGl0eVBsYXRmb3JtSW5jbHVkZXNPCiAgICAgLy8gYW5vbnltb3Vz IGJsb2NrcyB3aGljaCBhcmUgYXJpYS1yZWxhdGVkIHRvIHRoZW1zZWx2ZXMgaGF2ZSBhbiBhcmlh IHJvbGUsIG5vcgogICAgIC8vIGhhdmUgd2UgZW5jb3VudGVyZWQgaW5zdGFuY2VzIHdoZXJlIHRo ZSBwYXJlbnQgb2YgYW4gYW5vbnltb3VzIGJsb2NrIGFsc28gbGFja2VkCiAgICAgLy8gYW4gYXJp YSByb2xlIGJ1dCB0aGUgZ3JhbmRwYXJlbnQgaGFkIG9uZS4KLSAgICBpZiAocmVuZGVyZXIoKS0+ aXNBbm9ueW1vdXNCbG9jaygpICYmICFwYXJlbnQtPnJlbmRlcmVyKCktPmlzQm9keSgpCisgICAg aWYgKHJlbmRlcmVyKCkgJiYgcmVuZGVyZXIoKS0+aXNBbm9ueW1vdXNCbG9jaygpICYmICFwYXJl bnQtPnJlbmRlcmVyKCktPmlzQm9keSgpCiAgICAgICAgICYmIHBhcmVudC0+YXJpYVJvbGVBdHRy aWJ1dGUoKSA9PSBVbmtub3duUm9sZSkKICAgICAgICAgcmV0dXJuIElnbm9yZU9iamVjdDsKIApk aWZmIC0tZ2l0IGEvU291cmNlL1dlYktpdC9ndGsvdGVzdHMvdGVzdGF0ay5jIGIvU291cmNlL1dl YktpdC9ndGsvdGVzdHMvdGVzdGF0ay5jCmluZGV4IDcwOTVlYmU2M2Q5YjQ4ZjgwOGQxNDYxMDVj YzhhYmQxNzA1NmQ3MzUuLmNjOTBkOTQ3MjAxY2JiMjM2MDU3Y2ViOWZlOGE0MmU0ZDMzNWE1M2Mg MTAwNjQ0Ci0tLSBhL1NvdXJjZS9XZWJLaXQvZ3RrL3Rlc3RzL3Rlc3RhdGsuYworKysgYi9Tb3Vy Y2UvV2ViS2l0L2d0ay90ZXN0cy90ZXN0YXRrLmMKQEAgLTU2Miw2ICs1NjIsMTAgQEAgc3RhdGlj IHZvaWQgdGVzdFdlYmtpdEF0a0NvbWJvQm94KCkKICAgICBnX2Fzc2VydChzZWxlY3RlZEl0ZW0g PT0gaXRlbTEpOwogICAgIGdfb2JqZWN0X3VucmVmKHNlbGVjdGVkSXRlbSk7CiAKKyAgICAvKiBD aGVjayB0aGF0IHRoZSBtZW51IHBvcHVwIGhhcyAwIGxpbmtzIGFuZCBkb2Vzbid0IGNyYXNoIGZy b20gY2hlY2tpbmcuICovCisgICAgZ2ludCBuTGlua3MgPSBhdGtfaHlwZXJ0ZXh0X2dldF9uX2xp bmtzKEFUS19IWVBFUlRFWFQobWVudVBvcHVwKSk7CisgICAgZ19hc3NlcnRfY21waW50KG5MaW5r cywgPT0sIDApOworCiAgICAgLyogQ2hlY2sgdGhlIGltcGxlbWVudGF0aW9ucyBvZiB0aGUgQXRr QWN0aW9uIGludGVyZmFjZS4gKi8KICAgICBnX2Fzc2VydChBVEtfSVNfQUNUSU9OKGNvbWJvQm94 KSk7CiAgICAgQXRrQWN0aW9uKiBhdGtBY3Rpb24gPSBBVEtfQUNUSU9OKGNvbWJvQm94KTsK