Fix for crash in LayoutTests in isolated tree mode.
<rdar://problem/85315168>
Created attachment 444000 [details] Patch
Committed r285677 (244160@main): <https://commits.webkit.org/244160@main> All reviewed patches have been landed. Closing bug and clearing flags on attachment 444000 [details].
Comment on attachment 444000 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=444000&action=review > Tools/WebKitTestRunner/InjectedBundle/mac/AccessibilityUIElementMac.mm:582 > - NSString *value = descriptionOfValue(attributeValue(attribute).get()); > - [values appendFormat:@"%@: %@\n", attribute, value]; > + RetainPtr<NSString> value = descriptionOfValue(attributeValue(attribute).get()); > + [values appendFormat:@"%@: %@\n", attribute, value.get()]; I don’t understand this. Why do we need to retain the string?
(In reply to Darin Adler from comment #4) > Comment on attachment 444000 [details] > Patch > > View in context: > https://bugs.webkit.org/attachment.cgi?id=444000&action=review > > > Tools/WebKitTestRunner/InjectedBundle/mac/AccessibilityUIElementMac.mm:582 > > - NSString *value = descriptionOfValue(attributeValue(attribute).get()); > > - [values appendFormat:@"%@: %@\n", attribute, value]; > > + RetainPtr<NSString> value = descriptionOfValue(attributeValue(attribute).get()); > > + [values appendFormat:@"%@: %@\n", attribute, value.get()]; > > I don’t understand this. Why do we need to retain the string? Darin, I don't have a good explanation for this, but this doesn't crash any longer. The other way I found to avoid this crash is as follows: - NSString *description = descriptionOfValue(attributeValue(NSAccessibilityValueAttribute).get()); // the above crashes when you dereference description in any way, like description.length. + auto value = attributeValue(NSAccessibilityValueAttribute); + NSString *description = descriptionOfValue(value.get()); // doesn't crash if you description.length. attributeValue is doing some threading trickery because it is dispatching to a secondary, mocked thread and waiting, and then spinning the main thread run loop until the dispatched block is executed on the secondary thread. My hypothesis is that this is allowing the garbage collector to kick in and release the return value of attributeValue, unless is assigned to an lvalue. The stack trace of the crash is not inside descriptionOfValue though, but when dereferencing the description string which makes no much sense to me... would greatly appreciate it if you had any suggestion. Thanks!