[Webkit-unassigned] [Bug 150670] [AX] WebProcess from WebKitGtk+ 2.10.0 compiled in Debug mode hits ASSERT on textUnderElement

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=150670

--- Comment #6 from Joanmarie Diggs (irc: joanie) <jdiggs at igalia.com> ---
Created attachment 264603
  --> https://bugs.webkit.org/attachment.cgi?id=264603&action=review
test case

I can reproduce this crash and came up with a greatly simplified test case (attached).

It seems like there's some craziness taking place that eventually works its way to the accessibility code. For instance:

1. Delete the space inside the 'script' element and the crash goes away and the text gets rendered.

2. Get rid of the float style in the first list item and the crash goes away and the text gets rendered.

3. Get rid of the text-transform style in the second list item and the crash goes away and the text gets rendered.

If you instead leave the attached test case as-is and view it in a non-debug build, the text gets rendered and you can use the accessible text interface to get the text for each list item element.

When I first started looking at this bug, my question was: Are the two asserts in question still needed? (The layout test associated with the addition of those assertions still passes when run with a debug build from which those assertions have been removed.) Now my question is WTF is going on, especially with the first item above (removing the space inside the 'script' element makes the crash go away).

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.webkit.org/pipermail/webkit-unassigned/attachments/20151102/da9d1979/attachment-0001.html>