Bug 44149 – AX: Images within anchors causes crash

• Status: RESOLVED
• Resolution: FIXED
• Component: Accessibility

[Chris Guillory]

Created attachment 64662 [details]
Layout Test

The chromium render is crashing:
http://code.google.com/p/chromium/issues/detail?id=52538

I've attached a layout test the reproduces the crash. This is looks similar to the crash from
https://bugs.webkit.org/show_bug.cgi?id=42309

[chris fleizach]

chris i'm not getting a crash with this test on ToT (on a Snow leopard mac). Can you attach the crash log

[Chris Guillory]

Created attachment 64986 [details]
anchor-with-image-causes-crash-stderr.txt

Hey Chris. Not sure how I missed your message in email. Is this file you wanted? I'm seeing the crash on Vista and my checkout is at r65572.

[chris fleizach]

ah, something caught by the new assert. might be a new case not properly handled. still doesn't explain why it didn't crash for me

[Chris Guillory]

Looking at this again I'm only seeing the assert being hit and no crash occurring (if I remove the assert) for the layout test. Can you see the assert being hit in debug mode?

[chris fleizach]

i was pretty sure i ran my unit test in debug mode, so it should have asserted there and crashed. i must have done something wrong

[chris fleizach]

crashing for me too now

[chris fleizach]

i've been looking at what could be related

when you have code like

<ul>
<li style="display: inline;"><a href="http:"><img style="display: block;" src="" width="200" height="100"></a></li>
<li style="display: inline;"><a href="http:"><img  style="display: block;" src=""  width="200" height="100"></a></li>
<li style="display: inline;"><a href="http:"><img  style="display: block;" src="" width="200" height="100"></a></li>
</ul>

the <ul> reports that it has four children. there's a continuation that points to the 2nd image. 

the problem is that i don't know if it's a logic error in nextSibling(), an unaccounted case, or there's an issue in how continuations are stored in renderers.

[Chris Guillory]

Created attachment 67469 [details]
Similar Layout Test - divs within anchors

Original URL: http://o.aolcdn.com/cdn.webmail.aol.com/mailtour/affinity/en-us/

[Chris Guillory]

Created attachment 67756 [details]
Layout Tests that actually causes a crash

This layout test actually causes a crash.

[Dominic Mazzoni]

Created attachment 106928 [details]
Patch

[chris fleizach]

Comment on attachment 106928 [details]
Patch

this looks ok to me, can you also check if this fixes
https://bugs.webkit.org/show_bug.cgi?id=58930
r=me

[WebKit Review Bot]

Comment on attachment 106928 [details]
Patch

Clearing flags on attachment: 106928

Committed r94888: <http://trac.webkit.org/changeset/94888>

[WebKit Review Bot]

All reviewed patches have been landed.  Closing bug.