[Webkit-unassigned] [Bug 106922] REGRESSION (r139444): Crashes in three accessibility tests on GTK

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=106922


Joanmarie Diggs (irc: joanie) <jdiggs at igalia.com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |ASSIGNED
                 CC|                            |jdiggs at igalia.com




--- Comment #1 from Joanmarie Diggs (irc: joanie) <jdiggs at igalia.com>  2013-01-15 17:21:04 PST ---
While r139444 is officially the crasher cause; this really seems like an infinite loop that was just waiting to happen.

  0. parentObjectUnignored() calls parentObject()
  1. parentObject() calls isWebArea()
  2. isWebArea() calls roleValue()

  In the case of a table row:

  3. roleValue() calls isTableRow()
  4. isTableRow() calls parentTable() 

  For non-aria table rows, it looks at the renderer and gets the
  renderer's table and then gets the corresponding accessible from
  AXObjectCache. BUT for aria table rows, it works it's way up the
  accessible tree:

  5. parentTable() calls parentObjectUnignored()

Proposed patch comin' up.

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.