This is the crashing section of code: AccessibilityObject* objectAndOffsetUnignored(AccessibilityObject* coreObject, int& offset, bool ignoreLinks) { Node* endNode = static_cast<AccessibilityRenderObject*>(coreObject)->renderer()->node(); int endOffset = coreObject->selection().end().computeOffsetInContainerNode(); // Indication that something bogus has transpired. offset = -1; AccessibilityObject* realObject = coreObject; if (realObject->accessibilityIsIgnored()) realObject = realObject->parentObjectUnignored(); if (ignoreLinks && realObject->isLink()) <------- Guilty line realObject = realObject->parentObjectUnignored(); [...] } The issue here is that parentObjectUnignored may return null, particularly in the case that the AccessibilityObject is a WebArea.
Created attachment 69218 [details] Patch for this issue
Comment on attachment 69218 [details] Patch for this issue r=me
Committed r68665: <http://trac.webkit.org/changeset/68665>