Bug 105372 – accessibility/svg-bounds.html asserts

• Status: RESOLVED
• Resolution: FIXED
• Component: Accessibility

[Simon Fraser (smfr)]

Process:         DumpRenderTree [47695]
Path:            /Volumes/VOLUME/*/DumpRenderTree
Identifier:      DumpRenderTree
Version:         0
Code Type:       X86-64 (Native)
Parent Process:  Python [46425]
User ID:         501

Date/Time:       2012-12-18 17:16:18.713 -0800
OS Version:      Mac OS X 10.8.2 (12C54)
Report Version:  10

Crashed Thread:  0  Dispatch queue: com.apple.main-thread

Exception Type:  EXC_BAD_ACCESS (SIGSEGV)
Exception Codes: KERN_INVALID_ADDRESS at 0x00000000bbadbeef

VM Regions Near 0xbbadbeef:
--> 
    __TEXT                 00000001015fc000-0000000101698000 [  624K] r-x/rwx SM=COW  /Volumes/VOLUME/*

Application Specific Information:
CRASHING TEST: accessibility/svg-bounds.html

Thread 0 Crashed:: Dispatch queue: com.apple.main-thread
0   com.apple.WebCore             	0x00000001043f941e WebCore::RenderSVGRoot::mapLocalToContainer(WebCore::RenderLayerModelObject const*, WebCore::TransformState&, unsigned int, bool*) const + 190 (RenderSVGRoot.cpp:407)
1   com.apple.WebCore             	0x000000010438e77e WebCore::RenderObject::localToAbsolute(WebCore::FloatPoint const&, unsigned int) const + 110 (RenderObject.cpp:2052)
2   com.apple.WebCore             	0x000000010438e825 WebCore::RenderObject::absoluteFocusRingQuads(WTF::Vector<WebCore::FloatQuad, 0ul>&) + 101 (RenderObject.cpp:1217)
3   com.apple.WebCore             	0x0000000102f3fd3c WebCore::AccessibilityRenderObject::boundingBoxRect() const + 284 (AccessibilityRenderObject.cpp:792)
4   com.apple.WebCore             	0x0000000102f4001d WebCore::AccessibilityRenderObject::elementRect() const + 93 (AccessibilityRenderObject.cpp:830)
5   com.apple.WebCore             	0x0000000102f3819e WebCore::AccessibilityObject::clickPoint() + 46 (AccessibilityObject.cpp:512)
6   com.apple.WebCore             	0x0000000102f40104 WebCore::AccessibilityRenderObject::clickPoint() + 212 (AccessibilityRenderObject.cpp:840)
7   com.apple.WebCore             	0x00000001048f9fc6 -[WebAccessibilityObjectWrapper accessibilityAttributeValue:] + 21126 (WebAccessibilityObjectWrapper.mm:2642)
8   DumpRenderTree                	0x0000000101607d56 AccessibilityUIElement::clickPointX() + 38 (AccessibilityUIElementMac.mm:602)
9   DumpRenderTree                	0x00000001015ff9b4 getClickPointXCallback(OpaqueJSContext const*, OpaqueJSValue*, OpaqueJSString*, OpaqueJSValue const**) + 52 (AccessibilityUIElement.cpp:765)
10  com.apple.JavaScriptCore      	0x0000000101b0c0e6 JSC::JSCallbackObject<JSC::JSDestructibleObject>::getStaticValue(JSC::ExecState*, JSC::PropertyName) + 406 (JSCallbackObjectFunctions.h:535)
11  com.apple.JavaScriptCore      	0x0000000101b02fbd JSC::JSCallbackObject<JSC::JSDestructibleObject>::getOwnPropertySlot(JSC::JSCell*, JSC::ExecState*, JSC::PropertyName, JSC::PropertySlot&) + 1069 (JSCallbackObjectFunctions.h:165)
12  com.apple.JavaScriptCore      	0x00000001018b7ea6 JSC::JSCell::fastGetOwnPropertySlot(JSC::ExecState*, JSC::PropertyName, JSC::PropertySlot&) + 150 (JSObject.h:1222)
13  com.apple.JavaScriptCore      	0x00000001018cba4c JSC::JSValue::get(JSC::ExecState*, JSC::PropertyName, JSC::PropertySlot&) const + 204 (JSObject.h:1482)
14  com.apple.JavaScriptCore      	0x0000000101ca06b1 llint_slow_path_get_by_id + 241 (LLIntSlowPaths.cpp:915)
15  com.apple.JavaScriptCore      	0x0000000101ca9ad4 llint_op_get_by_id + 122
16  com.apple.JavaScriptCore      	0x0000000101aa4be4 JSC::JITCode::execute(JSC::JSStack*, JSC::ExecState*, JSC::JSGlobalData*) + 84 (JITCode.h:134)

[Simon Fraser (smfr)]

Skipped in Debug in http://trac.webkit.org/changeset/138094

[Dominic Mazzoni]

http://trac.webkit.org/changeset/138272