Bug 44136

Summary:

Crash in DumpRenderTree!notificationListenerProc when running plugins/access-after-page-destroyed.html

Product:

WebKit

Reporter:

Adam Roben (:aroben) <aroben>

Component:

Tools / Tests

Assignee:

Nobody <webkit-unassigned>

Status:

RESOLVED FIXED

Severity:

Normal

CC:

cfleizach, jhoneycutt

Priority:

Keywords:

InRadar, LayoutTestFailure, PlatformOnly

Version:

528+ (Nightly build)

Hardware:

OS:

Windows XP

URL:

http://build.webkit.org/results/Windows%20Release%20(Tests)/r65540%20(2834)/CrashLog_0e08_2010-08-17_15-52-59-764.txt

Attachments:

Description	Flags
Don't assume AccessibleObjectFromEvent succeeds	sam: review+

Adam Roben (:aroben)

Reported 2010-08-17 16:05:29 PDT

plugins/access-after-page-destroyed.html is crashing on the bots. The crash logs implicate DumpRenderTree!notificationListenerProc (see <http://build.webkit.org/results/Windows%20Release%20(Tests)/r65540%20(2834)/CrashLog_0e08_2010-08-17_15-52-59-764.txt>).

Attachments
Don't assume AccessibleObjectFromEvent succeeds (1.63 KB, patch) 2010-10-01 11:44 PDT, Adam Roben (:aroben)	sam: review+	Details Formatted Diff Diff
View All Add attachment proposed patch, testcase, etc.

Adam Roben (:aroben)

Comment 1 2010-08-17 16:10:10 PDT

<rdar://problem/8321684>

Adam Roben (:aroben)

Comment 2 2010-08-18 08:29:58 PDT

Looks like the crash is preceded by an assertion in debug builds: <http://build.webkit.org/results/Windows%20Debug%20(Tests)/r65606%20(18248)/CrashLog_0538_2010-08-18_07-01-47-171.txt> The failing assertion is: HRESULT hr = AccessibleObjectFromEvent(hwnd, idObject, idChild, &parentObject, &vChild); ASSERT(SUCCEEDED(hr)); Presumably we crash later because vChild is still null.

Adam Roben (:aroben)

Comment 3 2010-10-01 11:44:40 PDT

Created attachment 69491 [details] Don't assume AccessibleObjectFromEvent succeeds

Adam Roben (:aroben)

Comment 4 2010-10-01 11:57:07 PDT

Committed r68907: <http://trac.webkit.org/changeset/68907>

Jon Honeycutt

Comment 5 2010-10-01 16:22:19 PDT

Do you know which event we're receiving that AccessibleObjectFromEvent fails on?

Jon Honeycutt

Comment 6 2010-10-01 16:33:51 PDT

I think the bug here may be that AccessibilityController::resetToConsistentState() is not unhooking the "all events" hook set in AccessibilityController::addNotificationListener().

Note You need to log in before you can comment on or make changes to this bug.