Bug 44149 - AX: Images within anchors causes crash
Summary: AX: Images within anchors causes crash
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: Accessibility (show other bugs)
Version: 528+ (Nightly build)
Hardware: PC OS X 10.5
: P2 Normal
Assignee: chris fleizach
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2010-08-17 19:34 PDT by Chris Guillory
Modified: 2011-09-09 16:23 PDT (History)
2 users (show)

See Also:


Attachments
Layout Test (2.00 KB, patch)
2010-08-17 19:34 PDT, Chris Guillory
ctguil: review-
Details | Formatted Diff | Diff
anchor-with-image-causes-crash-stderr.txt (622 bytes, text/plain)
2010-08-20 13:39 PDT, Chris Guillory
no flags Details
Similar Layout Test - divs within anchors (2.21 KB, text/html)
2010-09-13 14:10 PDT, Chris Guillory
no flags Details
Layout Tests that actually causes a crash (1.98 KB, patch)
2010-09-15 18:44 PDT, Chris Guillory
no flags Details | Formatted Diff | Diff
Patch (5.94 KB, patch)
2011-09-09 15:14 PDT, Dominic Mazzoni
no flags Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Chris Guillory 2010-08-17 19:34:52 PDT
Created attachment 64662 [details]
Layout Test

The chromium render is crashing:
http://code.google.com/p/chromium/issues/detail?id=52538

I've attached a layout test the reproduces the crash. This is looks similar to the crash from
https://bugs.webkit.org/show_bug.cgi?id=42309
Comment 1 chris fleizach 2010-08-18 12:36:16 PDT
chris i'm not getting a crash with this test on ToT (on a Snow leopard mac). Can you attach the crash log
Comment 2 Chris Guillory 2010-08-20 13:39:36 PDT
Created attachment 64986 [details]
anchor-with-image-causes-crash-stderr.txt

Hey Chris. Not sure how I missed your message in email. Is this file you wanted? I'm seeing the crash on Vista and my checkout is at r65572.
Comment 3 chris fleizach 2010-08-20 13:45:24 PDT
ah, something caught by the new assert. might be a new case not properly handled. still doesn't explain why it didn't crash for me
Comment 4 Chris Guillory 2010-08-20 14:35:16 PDT
Looking at this again I'm only seeing the assert being hit and no crash occurring (if I remove the assert) for the layout test. Can you see the assert being hit in debug mode?
Comment 5 chris fleizach 2010-08-20 14:39:10 PDT
i was pretty sure i ran my unit test in debug mode, so it should have asserted there and crashed. i must have done something wrong
Comment 6 chris fleizach 2010-08-23 10:47:32 PDT
crashing for me too now
Comment 7 chris fleizach 2010-09-10 18:02:51 PDT
i've been looking at what could be related

when you have code like

<ul>
<li style="display: inline;"><a href="http:"><img style="display: block;" src="" width="200" height="100"></a></li>
<li style="display: inline;"><a href="http:"><img  style="display: block;" src=""  width="200" height="100"></a></li>
<li style="display: inline;"><a href="http:"><img  style="display: block;" src="" width="200" height="100"></a></li>
</ul>

the <ul> reports that it has four children. there's a continuation that points to the 2nd image. 

the problem is that i don't know if it's a logic error in nextSibling(), an unaccounted case, or there's an issue in how continuations are stored in renderers.
Comment 8 Chris Guillory 2010-09-13 14:10:42 PDT
Created attachment 67469 [details]
Similar Layout Test - divs within anchors

Original URL: http://o.aolcdn.com/cdn.webmail.aol.com/mailtour/affinity/en-us/
Comment 9 Chris Guillory 2010-09-15 18:44:07 PDT
Created attachment 67756 [details]
Layout Tests that actually causes a crash

This layout test actually causes a crash.
Comment 10 Dominic Mazzoni 2011-09-09 15:14:36 PDT
Created attachment 106928 [details]
Patch
Comment 11 chris fleizach 2011-09-09 15:55:08 PDT
Comment on attachment 106928 [details]
Patch

this looks ok to me, can you also check if this fixes
https://bugs.webkit.org/show_bug.cgi?id=58930
r=me
Comment 12 WebKit Review Bot 2011-09-09 16:23:30 PDT
Comment on attachment 106928 [details]
Patch

Clearing flags on attachment: 106928

Committed r94888: <http://trac.webkit.org/changeset/94888>
Comment 13 WebKit Review Bot 2011-09-09 16:23:35 PDT
All reviewed patches have been landed.  Closing bug.