Summary: | REGRESSION (r125710): accessibility/accessibility-node-reparent.html, accessibility/accessibility-node-memory-management.html failing on GTK Linux | ||||||||
---|---|---|---|---|---|---|---|---|---|
Product: | WebKit | Reporter: | Zan Dobersek <zan> | ||||||
Component: | Accessibility | Assignee: | Dominic Mazzoni <dmazzoni> | ||||||
Status: | RESOLVED FIXED | ||||||||
Severity: | Normal | CC: | apinheiro, cfleizach, dmazzoni, jdiggs, mario, mrobinson, svillar, webkit.review.bot | ||||||
Priority: | P2 | Keywords: | LayoutTestFailure, MakingBotsRed, Regression | ||||||
Version: | 528+ (Nightly build) | ||||||||
Hardware: | Unspecified | ||||||||
OS: | Unspecified | ||||||||
URL: | http://build.webkit.org/results/GTK%20Linux%2064-bit%20Release/r125710%20(27601)/results.html | ||||||||
Bug Depends on: | 94156 | ||||||||
Bug Blocks: | |||||||||
Attachments: |
|
Description
Zan Dobersek
2012-08-16 00:44:05 PDT
Moving component to accessibility and adding a couple of guys to de Cc. Also I'd like to point out the crash in accessibility/canvas-fallback-content.html: http://build.webkit.org/results/GTK%20Linux%2064-bit%20Debug/r125750%20(35657)/accessibility/canvas-fallback-content-crash-log.txt Program terminated with signal 11, Segmentation fault. #0 0x00007fdf573c2c32 in WebCore::Node::isFocusable (this=0x317c400) at ../../Source/WebCore/dom/Node.cpp:927 Thread 1 (Thread 0x7fdf4c6ce900 (LWP 1856)): #0 0x00007fdf573c2c32 in WebCore::Node::isFocusable (this=0x317c400) at ../../Source/WebCore/dom/Node.cpp:927 #1 0x00007fdf57049912 in WebCore::AccessibilityNodeObject::determineAccessibilityRole (this=0x31cdc60) at ../../Source/WebCore/accessibility/AccessibilityNodeObject.cpp:268 #2 0x00007fdf57048f4f in WebCore::AccessibilityNodeObject::init (this=0x31cdc60) at ../../Source/WebCore/accessibility/AccessibilityNodeObject.cpp:99 #3 0x00007fdf57048fa2 in WebCore::AccessibilityNodeObject::create (node=0x317c400) at ../../Source/WebCore/accessibility/AccessibilityNodeObject.cpp:105 #4 0x00007fdf57070e15 in WebCore::createFromNode (node=0x317c400) at ../../Source/WebCore/accessibility/AXObjectCache.cpp:283 #5 0x00007fdf570711a3 in WebCore::AXObjectCache::getOrCreate (this=0x315b8f0, node=0x317c400) at ../../Source/WebCore/accessibility/AXObjectCache.cpp:323 #6 0x00007fdf583eef94 in WebCore::AXObjectCache::handleFocusedUIElementChanged (this=0x315b8f0, oldFocusedNode=0x317cc20, newFocusedNode=0x317c400) at ../../Source/WebCore/accessibility/gtk/AXObjectCacheAtk.cpp:248 #7 0x00007fdf57332425 in WebCore::Document::setFocusedNode (this=0x313afc0, prpNewFocusedNode=...) at ../../Source/WebCore/dom/Document.cpp:3862 #8 0x00007fdf578684f1 in WebCore::FocusController::setFocusedNode (this=0x22df9e0, node=0x317c400, newFocusedFrame=...) at ../../Source/WebCore/page/FocusController.cpp:648 #9 0x00007fdf57382a2a in WebCore::Element::focus (this=0x317c400, restorePreviousSelection=true) at ../../Source/WebCore/dom/Element.cpp:1578 #10 0x00007fdf57fefc0b in WebCore::jsElementPrototypeFunctionFocus (exec=0x7fdf080b40d0) at DerivedSources/WebCore/JSElement.cpp:2023 *** Bug 94204 has been marked as a duplicate of this bug. *** Created attachment 159033 [details] Crash log The same crash also occurs in fast/canvas/fallback-content.html Also occurs on Apple Lion Debug WK2 bots: http://test-results.appspot.com/dashboards/flakiness_dashboard.html#group=%40ToT%20-%20webkit.org&showAllRuns=true&tests=accessibility%2Fcanvas-fallback-content.html%2Cfast%2Fcanvas%2Ffallback-content.html Attaching the complete crash log. FYI, the canvas-fallback-content crash is fixed by the patch on 94156. The GTK-specific failures will need some investigation, and I've updated the test expectations for now. The crash has been fixed. I debugged the test failures, and I have a patch. It was a bug in DumpRenderTree/gtk. Created attachment 159781 [details]
Patch
Looks good to me, but I think that Mario should double-check this one. (In reply to comment #7) > Looks good to me, but I think that Mario should double-check this one. Looks good to me too. Thanks for fixing these two, Dominic! Comment on attachment 159781 [details]
Patch
r=me
Comment on attachment 159781 [details] Patch Clearing flags on attachment: 159781 Committed r126309: <http://trac.webkit.org/changeset/126309> All reviewed patches have been landed. Closing bug. While working on other bug I run the tests, and for several of them I found several g_object_ref/g_object_unref on stderr. For example: +accessibility/aria-hidden-updates-alldescendants.html stderr g_object_ref: assertion `G_IS_OBJECT (object)' failed g_object_ref: assertion `G_IS_OBJECT (object)' failed g_object_unref: assertion `G_IS_OBJECT (object)' failed g_object_ref: assertion `G_IS_OBJECT (object)' failed g_object_unref: assertion `G_IS_OBJECT (object)' failed g_object_ref: assertion `G_IS_OBJECT (object)' failed g_object_unref: assertion `G_IS_OBJECT (object)' failed g_object_ref: assertion `G_IS_OBJECT (object)' failed g_object_ref: assertion `G_IS_OBJECT (object)' failed g_object_unref: assertion `G_IS_OBJECT (object)' failed g_object_ref: assertion `G_IS_OBJECT (object)' failed g_object_unref: assertion `G_IS_OBJECT (object)' failed g_object_ref: assertion `G_IS_OBJECT (object)' failed g_object_unref: assertion `G_IS_OBJECT (object)' failed g_object_ref: assertion `G_IS_OBJECT (object)' failed g_object_ref: assertion `G_IS_OBJECT (object)' failed g_object_unref: assertion `G_IS_OBJECT (object)' failed g_object_ref: assertion `G_IS_OBJECT (object)' failed g_object_unref: assertion `G_IS_OBJECT (object)' failed g_object_ref: assertion `G_IS_OBJECT (object)' failed g_object_unref: assertion `G_IS_OBJECT (object)' failed After investigating a little I found that this started to happen after the patch on this bug. If I revert the patch I don't get those messages. Should I reopen this bug? (In reply to comment #12) > While working on other bug I run the tests, and for several of them I found several g_object_ref/g_object_unref on stderr. For example: > > +accessibility/aria-hidden-updates-alldescendants.html stderr > > g_object_ref: assertion `G_IS_OBJECT (object)' failed > g_object_ref: assertion `G_IS_OBJECT (object)' failed > g_object_unref: assertion `G_IS_OBJECT (object)' failed > g_object_ref: assertion `G_IS_OBJECT (object)' failed > g_object_unref: assertion `G_IS_OBJECT (object)' failed > g_object_ref: assertion `G_IS_OBJECT (object)' failed > g_object_unref: assertion `G_IS_OBJECT (object)' failed > g_object_ref: assertion `G_IS_OBJECT (object)' failed > g_object_ref: assertion `G_IS_OBJECT (object)' failed > g_object_unref: assertion `G_IS_OBJECT (object)' failed > g_object_ref: assertion `G_IS_OBJECT (object)' failed > g_object_unref: assertion `G_IS_OBJECT (object)' failed > g_object_ref: assertion `G_IS_OBJECT (object)' failed > g_object_unref: assertion `G_IS_OBJECT (object)' failed > g_object_ref: assertion `G_IS_OBJECT (object)' failed > g_object_ref: assertion `G_IS_OBJECT (object)' failed > g_object_unref: assertion `G_IS_OBJECT (object)' failed > g_object_ref: assertion `G_IS_OBJECT (object)' failed > g_object_unref: assertion `G_IS_OBJECT (object)' failed > g_object_ref: assertion `G_IS_OBJECT (object)' failed > g_object_unref: assertion `G_IS_OBJECT (object)' failed > > > After investigating a little I found that this started to happen after the patch on this bug. If I revert the patch I don't get those messages. > > Should I reopen this bug? Seems as null pointers are passed into AccessibilityUIElement constructors. Perhaps using a GRefPtr would fix this in style? That is, using 'typedef GRefPtr<AtkObject> PlatformUIElement;' in AccessibilityUIElement.h. My vote would be a new bug. Reverting the ref/unref is definitely wrong, it'd be a step backwards to not have that. GRefPtr might help, but I think there are probably a couple of cases where a null check might be needed. It'd be best to actually debug these. (In reply to comment #14) > My vote would be a new bug. Done: https://bugs.webkit.org/show_bug.cgi?id=95062 |