[Webkit-unassigned] [Bug 120416] New: [GTK] AccessibilityUIElement::addNotificationListener() crashes on debug build

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=120416

           Summary: [GTK]
                    AccessibilityUIElement::addNotificationListener()
                    crashes on debug build
           Product: WebKit
           Version: 528+ (Nightly build)
          Platform: Unspecified
        OS/Version: Unspecified
            Status: UNCONFIRMED
          Severity: Normal
          Priority: P2
         Component: WebKit Gtk
        AssignedTo: webkit-unassigned at lists.webkit.org
        ReportedBy: d.nomiyama at samsung.com


The following tests are crashing on debug build after http://trac.webkit.org/changeset/154697.

accessibility/aria-checkbox-sends-notification-crash-log.txt
accessibility/multiselect-list-reports-active-option-crash-log.txt
accessibility/aria-invalid-crash-log.txt
accessibility/notification-listeners-crash-log.txt
accessibility/menu-list-sends-change-notification-crash-log.txt

Callstack is copied below.

#0  0x00007f65139aaec9 in WTFCrash () at ../../Source/WTF/wtf/Assertions.cpp:342
#1  0x00000000004a14b1 in WTF::RefCountedBase::ref (this=0xe94740) at ../../Source/WTF/wtf/RefCounted.h:59
#2  0x00000000004ad6e1 in WTF::refIfNotNull<AccessibilityNotificationHandler> (ptr=0xe94740) at ../../Source/WTF/wtf/PassRefPtr.h:46
#3  0x00000000004ad4e7 in WTF::RefPtr<AccessibilityNotificationHandler>::RefPtr (this=0x7fff62b2a330, ptr=0xe94740) at ../../Source/WTF/wtf/RefPtr.h:43
#4  0x00000000004ad1a0 in WTF::RefPtr<AccessibilityNotificationHandler>::operator= (this=0xe8dd78, optr=0xe94740) at ../../Source/WTF/wtf/RefPtr.h:126
#5  0x00000000004ac370 in AccessibilityUIElement::addNotificationListener (this=0xe8dd70, functionCallback=0x7f64c009dbf0) at ../../Tools/DumpRenderTree/atk/AccessibilityUIElementAtk.cpp:1038
#6  0x0000000000499742 in addNotificationListenerCallback (context=0x7f64b3c00108, function=0x7f64c005fbb0, thisObject=0x7f64c005fbf0, argumentCount=1, arguments=0x7fff62b2a400, exception=0x7fff62b2a498) at ../../Tools/DumpRenderTree/AccessibilityUIElement.cpp:1010
#7  0x00007f6513545921 in JSC::APICallbackFunction::call<JSC::JSCallbackFunction> (exec=0x7f64b3c00108) at ../../Source/JavaScriptCore/API/APICallbackFunction.h:59
#8  0x00007f6513800fd2 in JSC::LLInt::handleHostCall (execCallee=0x7f64b3c00108, pc=0xe18ec0, callee=..., kind=JSC::CodeForCall) at ../../Source/JavaScriptCore/llint/LLIntSlowPaths.cpp:949
#9  0x00007f6513804454 in JSC::LLInt::setUpCall (execCallee=0x7f64b3c00108, pc=0xe18ec0, kind=JSC::CodeForCall, calleeAsValue=..., callLinkInfo=0xdd0cd8) at ../../Source/JavaScriptCore/llint/LLIntSlowPaths.cpp:993
#10 0x00007f65138048f6 in JSC::LLInt::genericCall (exec=0x7f64b3c000a0, pc=0xe18ec0, kind=JSC::CodeForCall) at ../../Source/JavaScriptCore/llint/LLIntSlowPaths.cpp:1054
#11 0x00007f65138013b2 in JSC::LLInt::llint_slow_path_call (exec=0x7f64b3c000a0, pc=0xe18ec0) at ../../Source/JavaScriptCore/llint/LLIntSlowPaths.cpp:1060
...

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.