Bug 161878 - AX: Crash at WebCore::Range::compareBoundaryPoints(WebCore::Range::CompareHow, WebCore::Range const&, int&) const + 23
Summary: AX: Crash at WebCore::Range::compareBoundaryPoints(WebCore::Range::CompareHow...
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: Accessibility (show other bugs)
Version: WebKit Nightly Build
Hardware: All All
: P2 Normal
Assignee: Nobody
URL:
Keywords: InRadar
Depends on:
Blocks:
 
Reported: 2016-09-12 15:35 PDT by Nan Wang
Modified: 2016-09-12 18:00 PDT (History)
11 users (show)

See Also:


Attachments
patch (6.42 KB, patch)
2016-09-12 15:44 PDT, Nan Wang
no flags Details | Formatted Diff | Diff
patch (6.02 KB, patch)
2016-09-12 15:59 PDT, Nan Wang
no flags Details | Formatted Diff | Diff
patch (6.02 KB, patch)
2016-09-12 16:14 PDT, Nan Wang
cfleizach: review+
n_wang: commit-queue-
Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Nan Wang 2016-09-12 15:35:35 PDT
0   com.apple.WebCore             	0x00007fffc9e29fe7 WebCore::Range::compareBoundaryPoints(WebCore::Range::CompareHow, WebCore::Range const&, int&) const + 23
1   com.apple.WebCore             	0x00007fffc9507830 WebCore::AXObjectCache::rangeForUnorderedCharacterOffsets(WebCore::CharacterOffset const&, WebCore::CharacterOffset const&) + 400
2   com.apple.WebCore             	0x00007fffca2002e0 -[WebAccessibilityObjectWrapper rangeForTextMarkerRange:] + 224
3   com.apple.WebCore             	0x00007fffca2129e8 -[WebAccessibilityObjectWrapper accessibilityAttributeValue:forParameter:] + 15464

<rdar://problem/27821325>
Comment 1 Nan Wang 2016-09-12 15:37:03 PDT
In static bool characterOffsetsInOrder(const CharacterOffset& characterOffset1, const CharacterOffset& characterOffset2)

We are getting an NULL range because characterOffset1 is associated with a doctype node.
Comment 2 Nan Wang 2016-09-12 15:44:24 PDT
Created attachment 288625 [details]
patch
Comment 3 Nan Wang 2016-09-12 15:59:18 PDT
Created attachment 288629 [details]
patch

Fixed the build failure.
Comment 4 chris fleizach 2016-09-12 16:10:10 PDT
Comment on attachment 288629 [details]
patch

View in context: https://bugs.webkit.org/attachment.cgi?id=288629&action=review

> Source/WebCore/ChangeLog:9
> +        ranges based on the nodes that associated to the passed in CharacterOffsets. When the first node is a doctype

that are associated

> Source/WebCore/ChangeLog:10
> +        node, the first range will be a nullptr.  And dereferencing it leads to a crash. Fixed this by adding a 

one sentence

e a nullptr, and der
Comment 5 Nan Wang 2016-09-12 16:14:42 PDT
Created attachment 288632 [details]
patch

updated from review.
Comment 6 Nan Wang 2016-09-12 18:00:26 PDT
Committed r205845: <http://trac.webkit.org/changeset/205845>