ASSERTION FAILED: !m_layoutState (/Volumes/data/Web/WebKit-2/WebCore/rendering/RenderView.cpp:115 virtual void WebCore::RenderView::layout()) Program received signal EXC_BAD_ACCESS, Could not access memory. Reason: KERN_INVALID_ADDRESS at address: 0x00000000bbadbeef 0x0000000101afc46d in WebCore::RenderView::layout (this=0x119aaf898) at /Volumes/data/Web/WebKit-2/WebCore/rendering/RenderView.cpp:115 115 ASSERT(!m_layoutState); (gdb) bt #0 0x0000000101afc46d in WebCore::RenderView::layout (this=0x119aaf898) at /Volumes/data/Web/WebKit-2/WebCore/rendering/RenderView.cpp:115 #1 0x0000000101cb92f7 in WebCore::RenderObject::layoutIfNeeded (this=0x119aaf898) at RenderObject.h:479 #2 0x000000010139ece4 in WebCore::AccessibilityRenderObject::updateBackingStore (this=0x119c21e80) at /Volumes/data/Web/WebKit-2/WebCore/page/AccessibilityRenderObject.cpp:2537 #3 0x000000010138f235 in -[AccessibilityObjectWrapper accessibilityIsIgnored] (self=0x119c1a230, _cmd=0x7fff820a67d8) at /Volumes/data/Web/WebKit-2/WebCore/page/mac/AccessibilityObjectWrapper.mm:1530 #4 0x00007fff819c0431 in NSAccessibilityPostNotificationForObservedElement () #5 0x00000001013889e1 in WebCore::AXObjectCache::postNotification (this=0x119ad5aa0, renderer=0x119c218d8, message=@0x7fff5fbf9950) at /Volumes/data/Web/WebKit-2/WebCore/page/mac/AXObjectCacheMac.mm:68 #6 0x0000000101ae2a18 in WebCore::RenderTextControl::setInnerTextValue (this=0x119c218d8, innerTextValue=@0x7fff5fbf99f0) at /Volumes/data/Web/WebKit-2/WebCore/rendering/RenderTextControl.cpp:176 #7 0x0000000101ae7d4e in WebCore::RenderTextControlSingleLine::updateFromElement (this=0x119c218d8) at /Volumes/data/Web/WebKit-2/WebCore/rendering/
Created attachment 30671 [details] patch This patch fixes the problem where an AX notification can be posted while the render tree is being changed. this callout can cause other problems. the fix is to have a one shot timer post all the notifications after rendering is done this also consolidate postNotification and postNotificationToElement into one method
Assigned to cfleizach@apple.com for landing his own patch (simply to make this obvious in the commit queue).
http://trac.webkit.org/changeset/44266