Bug 42652 - CrashTracer: [USER] 300 crashes in Safari at com.apple.WebCore: WebCore::AccessibilityTable::isTableExposableThroughAccessibility + 573
: CrashTracer: [USER] 300 crashes in Safari at com.apple.WebCore: WebCore::Acce...
Status: RESOLVED FIXED
: WebKit
Accessibility
: 528+ (Nightly build)
: PC Mac OS X 10.5
: P2 Normal
Assigned To:
:
: InRadar
:
:
  Show dependency treegraph
 
Reported: 2010-07-20 10:45 PST by
Modified: 2010-07-20 14:35 PST (History)


Attachments
Patch (5.35 KB, patch)
2010-07-20 12:24 PST, chris fleizach
bdakin: review+
Review Patch | Details | Formatted Diff | Diff


Note

You need to log in before you can comment on or make changes to this bug.


Description From 2010-07-20 10:45:17 PST
55 com.apple.WebCore:  WebCore::AccessibilityTable::AccessibilityTable + 94 <==
          55 com.apple.WebCore:  WebCore::AccessibilityTable::create + 50
            55 com.apple.WebCore:  WebCore::AXObjectCache::getOrCreate + 1066
              28 com.apple.WebCore:  WebCore::AccessibilityTableCell::isTableCell const + 13
              | 28 com.apple.WebCore:  WebCore::AccessibilityTableCell::roleValue const + 21
              |   28 com.apple.WebCore:  WebCore::AccessibilityRenderObject::ariaLiveRegionStatus const + 96
              |     28 com.apple.WebCore:  WebCore::AccessibilityObject::supportsARIALiveRegion const + 18
              |       28 com.apple.WebCore:  WebCore::AccessibilityRenderObject::contentChanged + 72
              |         28 com.apple.WebCore:  WebCore::StyledElement::attributeChanged + 331
              |           28 com.apple.WebCore:  WebCore::NamedNodeMap::addAttribute + 119
              |             26 com.apple.WebCore:  WebCore::Element::setAttribute + 594
              |             | 26 com.apple.WebCore:  WebCore::Element::setAttribute + 17
              |             |   26 com.apple.WebCore:  WebCore::setJSHTMLElementTitle + 102
              |             |     26 com.apple.WebCore:  WebCore::JSHTMLElement::put + 186
              |             |       26 com.apple.WebCore:  WebCore::JSHTMLTableCellElement::put + 133
------- Comment #1 From 2010-07-20 10:46:49 PST -------
this can happen when  you remove a row from a table, then add a row, then modify an attribute on the new row.

That will cause the AccessibilityTable to see if it should be exposed as a table.  That in turn will look at its grid of cells, accessing the row that was removed. 

the solution is that we cannot use getOrCreate in contentChanged(). we can only access AX elements already created.
------- Comment #2 From 2010-07-20 12:19:57 PST -------
Actually a better solution is that the table cell should not getOrCreate its parent. it should only get it's parent.

There's no real user cases where a table cell will be created in AX, before its AXTable is created
------- Comment #3 From 2010-07-20 12:24:05 PST -------
Created an attachment (id=62099) [details]
Patch
------- Comment #4 From 2010-07-20 14:09:07 PST -------
(From update of attachment 62099 [details])
r=me!
------- Comment #5 From 2010-07-20 14:35:40 PST -------
http://trac.webkit.org/changeset/63774