RESOLVED DUPLICATE of bug 207093 207035
[GTK] ASSERTION FAILED: accessible->priv->object != fallbackObject() 
https://bugs.webkit.org/show_bug.cgi?id=207035
Summary [GTK] ASSERTION FAILED: accessible->priv->object != fallbackObject()
Sergio Villar Senin
Reported 2020-01-31 02:57:29 PST
Created attachment 389336 [details] Backtrace Preconditions: WebKitGTK Debug build Steps to reproduce: 1. Run Minibrowser It'll crash 100% of the times I'm attaching the whole backtrace, this is an excerpt #0 WTFCrash () at ../../Source/WTF/wtf/Assertions.cpp:305 #1 0x00007ff7313d63c0 in CRASH_WITH_INFO(...) () at DerivedSources/ForwardingHeaders/wtf/Assertions.h:660 #2 0x00007ff73334e936 in webkitAccessibleDetach (accessible=0x562198549ea0) at ../../Source/WebCore/accessibility/atk/WebKitAccessible.cpp:1308 #3 0x00007ff733348bbe in WebCore::AccessibilityObject::detachPlatformWrapper (this=0x7ff71b48cac8, detachmentType=WebCore::AccessibilityDetachmentType::ElementDestroyed) at ../../Source/WebCore/accessibility/atk/AccessibilityObjectAtk.cpp:47 #4 0x00007ff7332ca19b in WebCore::AXCoreObject::detachWrapper (this=0x7ff71b48cac8, detachmentType=WebCore::AccessibilityDetachmentType::ElementDestroyed) at ../../Source/WebCore/accessibility/AccessibilityObjectInterface.h:1158 #5 0x00007ff7332ca12e in WebCore::AXCoreObject::detach (this=0x7ff71b48cac8, detachmentType=WebCore::AccessibilityDetachmentType::ElementDestroyed) at ../../Source/WebCore/accessibility/AccessibilityObjectInterface.h:1150 #6 0x00007ff7332ba85b in WebCore::AXObjectCache::remove (this=0x7ff71b448000, axID=1) at ../../Source/WebCore/accessibility/AXObjectCache.cpp:853 #7 0x00007ff7332bab56 in WebCore::AXObjectCache::remove (this=0x7ff71b448000, view=0x7ff71ab5c010) at ../../Source/WebCore/accessibility/AXObjectCache.cpp:895 #8 0x00007ff7340e3058 in WebCore::FrameView::removeFromAXObjectCache (this=0x7ff71ab5c010) at ../../Source/WebCore/page/FrameView.cpp:280 #9 0x00007ff7340e32ac in WebCore::FrameView::prepareForDetach (this=0x7ff71ab5c010) at ../../Source/WebCore/page/FrameView.cpp:329 I don't know much about WK's a11y but in general, dispose() methods can be called multiple times as opposed to destroy().
Attachments
Backtrace (10.10 KB, text/plain)
2020-01-31 02:57 PST, Sergio Villar Senin 		no flags
Details
First call to detach (9.31 KB, text/plain)
2020-01-31 03:30 PST, Sergio Villar Senin 		no flags
Details
2nd call to detach (5.33 KB, text/plain)
2020-01-31 03:31 PST, Sergio Villar Senin 		no flags
Details
View All Add attachment proposed patch, testcase, etc.
Radar WebKit Bug Importer
Comment 1 2020-01-31 02:57:37 PST
<rdar://problem/59057790>
Sergio Villar Senin
Comment 2 2020-01-31 03:30:57 PST
Created attachment 389338 [details] First call to detach
Sergio Villar Senin
Comment 3 2020-01-31 03:31:12 PST
Created attachment 389339 [details] 2nd call to detach
Sergio Villar Senin
Comment 4 2020-01-31 03:31:44 PST
I've just attached a couple of backtraces of the 2 calls to detach(). The first one sets the fallback object and the second asserts because of this.
Jonathan Kingston
Comment 5 2020-02-01 10:34:20 PST
I just saw this after filing Bug 207093, however I attached a patch there.
Carlos Garcia Campos
Comment 6 2020-02-03 01:44:25 PST
*** This bug has been marked as a duplicate of bug 207093 ***
Note You need to log in before you can comment on or make changes to this bug.