Bug 42652 – CrashTracer: [USER] 300 crashes in Safari at com.apple.WebCore: WebCore::AccessibilityTable::isTableExposableThroughAccessibility + 573

• Status: RESOLVED
• Resolution: FIXED
• Component: Accessibility

[chris fleizach]

55 com.apple.WebCore:  WebCore::AccessibilityTable::AccessibilityTable + 94 <==
          55 com.apple.WebCore:  WebCore::AccessibilityTable::create + 50
            55 com.apple.WebCore:  WebCore::AXObjectCache::getOrCreate + 1066
              28 com.apple.WebCore:  WebCore::AccessibilityTableCell::isTableCell const + 13
              | 28 com.apple.WebCore:  WebCore::AccessibilityTableCell::roleValue const + 21
              |   28 com.apple.WebCore:  WebCore::AccessibilityRenderObject::ariaLiveRegionStatus const + 96
              |     28 com.apple.WebCore:  WebCore::AccessibilityObject::supportsARIALiveRegion const + 18
              |       28 com.apple.WebCore:  WebCore::AccessibilityRenderObject::contentChanged + 72
              |         28 com.apple.WebCore:  WebCore::StyledElement::attributeChanged + 331
              |           28 com.apple.WebCore:  WebCore::NamedNodeMap::addAttribute + 119
              |             26 com.apple.WebCore:  WebCore::Element::setAttribute + 594
              |             | 26 com.apple.WebCore:  WebCore::Element::setAttribute + 17
              |             |   26 com.apple.WebCore:  WebCore::setJSHTMLElementTitle + 102
              |             |     26 com.apple.WebCore:  WebCore::JSHTMLElement::put + 186
              |             |       26 com.apple.WebCore:  WebCore::JSHTMLTableCellElement::put + 133

[chris fleizach]

this can happen when  you remove a row from a table, then add a row, then modify an attribute on the new row.

That will cause the AccessibilityTable to see if it should be exposed as a table.  That in turn will look at its grid of cells, accessing the row that was removed. 

the solution is that we cannot use getOrCreate in contentChanged(). we can only access AX elements already created.

[chris fleizach]

Actually a better solution is that the table cell should not getOrCreate its parent. it should only get it's parent.

There's no real user cases where a table cell will be created in AX, before its AXTable is created

[chris fleizach]

Created attachment 62099 [details]
Patch

[Beth Dakin]

Comment on attachment 62099 [details]
Patch

r=me!

[chris fleizach]

http://trac.webkit.org/changeset/63774