Bug 158685 – AX: CrashTracer: com.apple.WebKit.WebContent at WebCore::AccessibilityRenderObject::remoteSVGRootElement const + 227

• Status: RESOLVED
• Resolution: FIXED
• Component: Accessibility

[chris fleizach]

Exception Codes:       KERN_INVALID_ADDRESS at 0x0000000000000000

Thread 0 Crashed ↩:: Dispatch queue: com.apple.main-thread
0   com.apple.WebCore             	0x1102ec6d3 WebCore::AccessibilityRenderObject::remoteSVGRootElement(WebCore::AccessibilityRenderObject::CreationChoice) const + 227 (/Library/Caches/com.apple.xbs/Sources/WebCore/WebCore-7602.1.35/accessibility/AccessibilitySVGRoot.h:55)
1   com.apple.WebCore             	0x1102e427b WebCore::AccessibilityRenderObject::detach(WebCore::AccessibilityDetachmentType, WebCore::AXObjectCache*) + 27 (/Library/Caches/com.apple.xbs/Sources/WebCore/WebCore-7602.1.35/accessibility/AccessibilityRenderObject.cpp:2976)
2   com.apple.WebCore             	0x11035bfb9 WebCore::AXObjectCache::~AXObjectCache() + 153 (/Library/Caches/com.apple.xbs/Sources/WebCore/WebCore-7602.1.35/accessibility/AXObjectCache.cpp:193)
3   com.apple.WebCore             	0x1104dc4d4 WebCore::Document::destroyRenderTree() + 116 (/Applications/Xcode.app/Contents/Developer/Toolchains/OSX10.11.xctoolchain/usr/bin/../include/c++/v1/memory:2459)
4   com.apple.WebCore             	0x1100a4a06 WebCore::Document::prepareForDestruction() + 358 (/Library/Caches/com.apple.xbs/Sources/WebCore/WebCore-7602.1.35/dom/Document.cpp:2325)

---

Smoking gun

    if (!is<AccessibilitySVGRoot>(*rootSVGObject))

Trying to take nil ptr rootSVGObject and dereference it


<rdar://problem/26755269>

[chris fleizach]

Created attachment 281159 [details]
Patch

[David Kilzer (:ddkilzer)]

Comment on attachment 281159 [details]
Patch

r=me

[WebKit Commit Bot]

Comment on attachment 281159 [details]
Patch

Clearing flags on attachment: 281159

Committed r202014: <http://trac.webkit.org/changeset/202014>

[WebKit Commit Bot]

All reviewed patches have been landed.  Closing bug.