Bug 112396 - AX: Crash when removing aria-menu item from DOM
Summary: AX: Crash when removing aria-menu item from DOM
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: Accessibility (show other bugs)
Version: 528+ (Nightly build)
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: chris fleizach
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2013-03-14 17:58 PDT by chris fleizach
Modified: 2013-03-14 19:10 PDT (History)
6 users (show)

See Also:

Attachments
patch (4.32 KB, patch)
2013-03-14 18:01 PDT, chris fleizach 		no flags Details | Formatted Diff | Diff
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description chris fleizach 2013-03-14 17:58:29 PDT 
If you have a aria menu in the tree, then removing it from the DOM leads to a crash NULL access crash

>  1 com.apple.WebCore              0x7fff8ee43c4d WebCore::AccessibilityRenderObject::parentObject() const + 0x7d
   2 com.apple.WebCore              0x7fff8ee43bb6 WebCore::AccessibilityRenderObject::ariaIsHidden() const + 0x86
   3 com.apple.WebCore              0x7fff8f2291e2 WebCore::AccessibilityRenderObject::accessibilityIsIgnoredBase() const + 0x52
   4 com.apple.WebCore              0x7fff8f234d07 WebCore::AccessibilityRenderObject::computeAccessibilityIsIgnored() const + 0x17
   5 com.apple.WebCore              0x7fff8f234264 WebCore::AccessibilityObject::accessibilityIsIgnored() const + 0x84
   6 com.apple.WebCore              0x7fff8f228600 WebCore::AXObjectCache::recomputeIsIgnored(WebCore::RenderObject*) + 0x20
   7 com.apple.WebCore              0x7fff8ee02e02 WebCore::RenderBlock::removeChild(WebCore::RenderObject*) + 0x3d2
   8 com.apple.WebCore              0x7fff8f94691d WebCore::RenderObject::willBeDestroyed() + 0xcd
   9 com.apple.WebCore              0x7fff8f996e2e WebCore::RenderText::willBeDestroyed() + 0xae
  10 com.apple.WebCore              0x7fff8ee02992 WebCore::RenderObject::destroy() + 0x12
  11 com.apple.WebCore              0x7fff8ede5890 WebCore::Node::detach() + 0x40
  12 com.apple.WebCore              0x7fff8ede582c WebCore::ContainerNode::detach() + 0x1c
  13 com.apple.WebCore              0x7fff8ede57dd WebCore::Element::detach() + 0x1ed
  14 com.apple.WebCore              0x7fff8ede582c WebCore::ContainerNode::detach() + 0x1c
  15 com.apple.WebCore              0x7fff8ede57dd WebCore::Element::detach() + 0x1ed
  16 com.apple.WebCore              0x7fff8ede582c WebCore::ContainerNode::detach() + 0x1c
  17 com.apple.WebCore              0x7fff8ede57dd WebCore::Element::detach() + 0x1ed
  18 com.apple.WebCore              0x7fff8ede582c WebCore::ContainerNode::detach() + 0x1c
  19 com.apple.WebCore              0x7fff8ede57dd WebCore::Element::detach() + 0x1ed
  20 com.apple.WebCore              0x7fff8ede582c WebCore::ContainerNode::detach() + 0x1c
Comment 1 chris fleizach 2013-03-14 18:01:51 PDT 
Created attachment 193212 [details]
patch
Comment 2 chris fleizach 2013-03-14 18:02:34 PDT 
Adding Tim to help with review
Comment 3 WebKit Review Bot 2013-03-14 19:10:53 PDT 
Comment on attachment 193212 [details]
patch

Clearing flags on attachment: 193212

Committed r145866: <http://trac.webkit.org/changeset/145866>
Comment 4 WebKit Review Bot 2013-03-14 19:10:56 PDT 
All reviewed patches have been landed.  Closing bug.