Bug 153553 – AX: Crash in AccessibilityTableColumn::headerObject

• Component: Accessibility
• Status: RESOLVED FIXED

[Nan Wang]

0   com.apple.WebCore             	0x7fff913b9a21 WebCore::AccessibilityTableColumn::headerObject() + 17 (/BuildRoot/Library/Caches/com.apple.xbs/Sources/WebCore/WebCore-7601.3.4/accessibility/AccessibilityTableColumn.cpp:72)
1   com.apple.WebCore             	0x7fff913b80c8 WebCore::AccessibilityTable::columnHeaders(WTF::Vector<WTF::RefPtr<WebCore::AccessibilityObject>, 0ul, WTF::CrashOnOverflow, 16ul>&) + 72 (/BuildRoot/Library/Caches/com.apple.xbs/Sources/WebCore/WebCore-7601.3.4/accessibility/AccessibilityTable.cpp:521)
2   com.apple.WebCore             	0x7fff913b9fc9 WebCore::AccessibilityTableHeaderContainer::addChildren() + 73 (/BuildRoot/Library/Caches/com.apple.xbs/Sources/WebCore/WebCore-7601.3.4/accessibility/AccessibilityTableHeaderContainer.cpp:80)
3   com.apple.WebCore             	0x7fff913a2052 WebCore::AccessibilityObject::updateChildrenIfNecessary() + 66 (/BuildRoot/Library/Caches/com.apple.xbs/Sources/WebCore/WebCore-7601.3.4/accessibility/AccessibilityObject.cpp:1650)

[Nan Wang]

<rdar://problem/23196278>

[Nan Wang]

Created attachment 270016 [details]
patch

Still have some difficulties reproducing the crash in a layout test. Will dig into it more later.

[chris fleizach]

Comment on attachment 270016 [details]
patch

View in context: https://bugs.webkit.org/attachment.cgi?id=270016&action=review

> Source/WebCore/ChangeLog:12
> +        function calls elementRect() for each child cell and that sometimes cause 

sometimes "causes"

> Source/WebCore/accessibility/AccessibilityTable.cpp:506
> +    AccessibilityChildrenVector columnsCopy  = m_columns;

bad spacing.

> Source/WebCore/accessibility/AccessibilityTable.cpp:522
> +    AccessibilityChildrenVector rowsCopy  = m_rows;

bad spacing

> Source/WebCore/accessibility/AccessibilityTableColumn.cpp:66
> +    // This was calculated and cached in addChildren() previously, however sometimes elementRect()

change comment to something like

"This used to be cached during the call to addChildren(), but calling elementRect() can invalidate elements, so its better to ask for this on demand"

> Source/WebCore/accessibility/AccessibilityTableColumn.cpp:71
> +    for (const auto& cell : m_children)

should we make a copy of m_children here in case it invalidates something

[Nan Wang]

Created attachment 270021 [details]
patch

[Build Bot]

Comment on attachment 270021 [details]
patch

Attachment 270021 [details] did not pass mac-debug-ews (mac):
Output: http://webkit-queues.webkit.org/results/746751

New failing tests:
imported/w3c/web-platform-tests/streams-api/readable-streams/garbage-collection-1.html

[Build Bot]

Created attachment 270029 [details]
Archive of layout-test-results from ews116 for mac-yosemite

The attached test failures were seen while running run-webkit-tests on the mac-debug-ews.
Bot: ews116  Port: mac-yosemite  Platform: Mac OS X 10.10.5

[Nan Wang]

(In reply to comment #5)
> Comment on attachment 270021 [details]
> patch
> 
> Attachment 270021 [details] did not pass mac-debug-ews (mac):
> Output: http://webkit-queues.webkit.org/results/746751
> 
> New failing tests:
> imported/w3c/web-platform-tests/streams-api/readable-streams/garbage-
> collection-1.html

The test failure might relate to https://bugs.webkit.org/show_bug.cgi?id=152436

[WebKit Commit Bot]

Comment on attachment 270021 [details]
patch

Clearing flags on attachment: 270021

Committed r195705: <http://trac.webkit.org/changeset/195705>

[WebKit Commit Bot]

All reviewed patches have been landed.  Closing bug.