Bug 45697 – CrashTracer: 874 crashes in Safari at com.apple.WebCore: WebCore::AccessibilityTable::isTableExposableThroughAccessibility + 663

• Component: Accessibility
• Status: RESOLVED FIXED

[chris fleizach]

Thread 0 Crashed ↩:  Dispatch queue: com.apple.main-thread
0   com.apple.WebCore             	0x7fff85834757 WebCore::AccessibilityTable::isTableExposableThroughAccessibility() + 663 (/SourceCache/WebCore/WebCore-7533.16/accessibility/AccessibilityTable.cpp:166)
1   com.apple.WebCore             	0x7fff858344ae WebCore::AccessibilityTable::AccessibilityTable(WebCore::RenderObject*) + 94 (/SourceCache/WebCore/WebCore-7533.16/accessibility/AccessibilityTable.cpp:57)
2   com.apple.WebCore             	0x7fff85834422 WebCore::AccessibilityTable::create(WebCore::RenderObject*) + 50 (/System/Library/Frameworks/JavaScriptCore.framework/PrivateHeaders/PassRefPtr.h:107)
3   com.apple.WebCore             	0x7fff85827c7a WebCore::AXObjectCache::getOrCreate(WebCore::RenderObject*) + 1066 (/System/Library/Frameworks/JavaScriptCore.framework/PrivateHeaders/RefPtr.h:148)
4   com.apple.WebCore             	0x7fff8583507d WebCore::AccessibilityTableRow::isTableRow() const + 13 (/SourceCache/WebCore/WebCore-7533.16/accessibility/AccessibilityTableRow.cpp:70)
5   com.apple.WebCore             	0x7fff85835c95 WebCore::AccessibilityTableRow::roleValue() const + 21 (/SourceCache/WebCore/WebCore-7533.16/accessibility/AccessibilityTableRow.cpp:62)
6   com.apple.WebCore             	0x7fff85833260 WebCore::AccessibilityRenderObject::ariaLiveRegionStatus() const + 96 (/SourceCache/WebCore/WebCore-7533.16/accessibility/AccessibilityRenderObject.cpp:3269)
7   com.apple.WebCore             	0x7fff858331b2 WebCore::AccessibilityObject::supportsARIALiveRegion() const + 18 (/SourceCache/WebCore/WebCore-7533.16/accessibility/AccessibilityObject.cpp:980)
8   com.apple.WebCore             	0x7fff8583bb48 WebCore::AccessibilityRenderObject::contentChanged() + 72 (/SourceCache/WebCore/WebCore-7533.16/accessibility/AccessibilityRenderObject.cpp:3131)
9   com.apple.WebCore             	0x7fff854b610b WebCore::StyledElement::attributeChanged(WebCore::Attribute*, bool) + 331 (/SourceCache/WebCore/WebCore-7533.16/

[chris fleizach]

very similar to 
https://bugs.webkit.org/show_bug.cgi?id=42652

[chris fleizach]

Created attachment 67459 [details]
patch

[Darin Adler]

Comment on attachment 67459 [details]
patch

Are all the callers of parentTable prepared to get 0? Will this harm correctness by returning 0 just because there’s no existing accessibility wrapper? What’s the design here?

[chris fleizach]

(In reply to comment #3)
> (From update of attachment 67459 [details])
> Are all the callers of parentTable prepared to get 0? Will this harm correctness by returning 0 just because there’s no existing accessibility wrapper? What’s the design here?

parentTable() is used to determine if the AccessibilityTableRow should be exposed an AXRow or just a regular object. That is, it checks to see if its parent is a table, and if so, it becomes a row. If 0 is returned, those cases are covered (just checked).

[chris fleizach]

http://trac.webkit.org/changeset/67407