AccessibilityMenuListOption::elementRect() returns the value of the grandparent MenuList. If we have an existing MenuListOption and the widget backing MenuList was just removed from the document, calling AccessibilityMenuListOption::elementRect() will crash the web process.
<rdar://problem/18980391>
Created attachment 241555 [details] Patch
Comment on attachment 241555 [details] Patch Sounds reasonable to me, but you could just early return if the null-check fails before the ASSERT, and leave the assertion in place. That way, if the parent/grandparent is not null, you would still be asserting the right role.
Created attachment 241574 [details] Patch
Comment on attachment 241574 [details] Patch Attachment 241574 [details] did not pass mac-wk2-ews (mac-wk2): Output: http://webkit-queues.appspot.com/results/6306052337303552 Number of test failures exceeded the failure limit.
Created attachment 241581 [details] Archive of layout-test-results from webkit-ews-13 for mac-mountainlion-wk2 The attached test failures were seen while running run-webkit-tests on the mac-wk2-ews. Bot: webkit-ews-13 Port: mac-mountainlion-wk2 Platform: Mac OS X 10.8.5
Created attachment 241584 [details] Patch
Comment on attachment 241584 [details] Patch The previous, failureful version returned LayoutRect(). This version returns boundingBoxRect() which is what often gets returned for non MenuList elements. According to the EWS and my Mac Mini, returning boundingBoxRect() here seems sane. Having said that, I was surprised at how a sanity check in accessibility code could break so many non-accessibility tests on the Mac. So... Chris, please review. Thanks!!
Comment on attachment 241584 [details] Patch Clearing flags on attachment: 241584 Committed r176254: <http://trac.webkit.org/changeset/176254>
All reviewed patches have been landed. Closing bug.