Bug 194630 – REGRESSION(r241289): [GTK] accessibility/removed-continuation-element-causes-crash.html and accessibility/removed-anonymous-block-child-causes-crash.html crashes

• Status: RESOLVED
• Resolution: FIXED
• Component: WebKitGTK

[Alicia Boya García]

The following layout tests are crashing on GTK

accessibility/removed-anonymous-block-child-causes-crash.html

atk_object_set_parent: assertion 'ATK_IS_OBJECT (accessible)' failed
LEAK: 1 WebPageProxy

Thread 1 (Thread 0x7f0d3f10cac0 (LWP 28267)):
#0  _g_log_abort () at ../../Source/glib-2.58.1/glib/gmessages.c:557
#1  0x00007f0d46a46485 in g_logv () at ../../Source/glib-2.58.1/glib/gmessages.c:1371
#2  0x00007f0d46a465d2 in g_log () at ../../Source/glib-2.58.1/glib/gmessages.c:1413
#3  0x00007f0d59fb2427 in webkitAccessibleRefChild (object=0x55afd30c0740, index=2) at ../../Source/WebCore/accessibility/atk/WebKitAccessibleWrapperAtk.cpp:389
#4  0x00007f0cf4965e5e in WTR::AccessibilityUIElement::getChildrenWithRange (this=0x7f0cc8d76da0, children=WTF::Vector of length 0, capacity 0, location=2, length=1) at /home/slave/webkitgtk/gtk-linux-64-debug/build/Tools/WebKitTestRunner/InjectedBundle/atk/AccessibilityUIElementAtk.cpp:801
#5  0x00007f0cf496630c in WTR::AccessibilityUIElement::childAtIndex (this=0x7f0cc8d76da0, index=2) at /home/slave/webkitgtk/gtk-linux-64-debug/build/Tools/WebKitTestRunner/InjectedBundle/atk/AccessibilityUIElementAtk.cpp:845
#6  0x00007f0cf4948206 in WTR::JSAccessibilityUIElement::childAtIndex (context=0x7fff037e8c20, thisObject=0x7f0cf40feb80, argumentCount=1, arguments=0x7fff037e8ad0, exception=0x7fff037e8ab8) at /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/DerivedSources/InjectedBundle/JSAccessibilityUIElement.cpp:311
#7  0x00007f0d4c8bc01a in JSC::APICallbackFunction::call<JSC::JSCallbackFunction> (exec=0x7fff037e8c20) at ../../Source/JavaScriptCore/API/APICallbackFunction.h:63
#8  0x00007f0cf70a302d in ?? ()
#9  0x00007fff037e8cd0 in ?? ()
#10 0x00007f0d4d5c08d1 in llint_op_call () at ../../Source/WTF/wtf/Ref.h:119
#11 0x0000000000000000 in ?? ()

accessibility/removed-continuation-element-causes-crash.html

atk_object_set_parent: assertion 'ATK_IS_OBJECT (accessible)' failed
LEAK: 1 WebPageProxy

Thread 1 (Thread 0x7f83a3cb9ac0 (LWP 31484)):
#0  _g_log_abort () at ../../Source/glib-2.58.1/glib/gmessages.c:557
#1  0x00007f83ab5f3485 in g_logv () at ../../Source/glib-2.58.1/glib/gmessages.c:1371
#2  0x00007f83ab5f35d2 in g_log () at ../../Source/glib-2.58.1/glib/gmessages.c:1413
#3  0x00007f83beb5f427 in webkitAccessibleRefChild (object=0x559b17ad6120, index=0) at ../../Source/WebCore/accessibility/atk/WebKitAccessibleWrapperAtk.cpp:389
#4  0x00007f8359565cf4 in WTR::AccessibilityUIElement::getChildren (this=0x7f83408bcb60, children=WTF::Vector of length 0, capacity 0) at /home/slave/webkitgtk/gtk-linux-64-debug/build/Tools/WebKitTestRunner/InjectedBundle/atk/AccessibilityUIElementAtk.cpp:790
#5  0x00007f83595671c0 in WTR::AccessibilityUIElement::attributesOfChildren (this=0x7f83408bcb60) at /home/slave/webkitgtk/gtk-linux-64-debug/build/Tools/WebKitTestRunner/InjectedBundle/atk/AccessibilityUIElementAtk.cpp:1066
#6  0x00007f8359549715 in WTR::JSAccessibilityUIElement::attributesOfChildren (context=0x7ffc0441a4b0, thisObject=0x7f83584fc210, argumentCount=0, arguments=0x7ffc0441a360, exception=0x7ffc0441a348) at /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/DerivedSources/InjectedBundle/JSAccessibilityUIElement.cpp:642
#7  0x00007f83b146901a in JSC::APICallbackFunction::call<JSC::JSCallbackFunction> (exec=0x7ffc0441a4b0) at ../../Source/JavaScriptCore/API/APICallbackFunction.h:63
#8  0x00007f835bca302d in ?? ()
#9  0x00007ffc0441a520 in ?? ()
#10 0x00007f83b216d95b in llint_op_call () at ../../Source/WTF/wtf/Ref.h:119
#11 0x0000000000000000 in ?? ()

[Carlos Garcia Campos]

Created attachment 367316 [details]
Patch

[Carlos Garcia Campos]

Committed r244498: <https://trac.webkit.org/changeset/244498>