[Webkit-unassigned] [Bug 155943] New: AX: Crash when AX trying to create element for an old auto fill element

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=155943

            Bug ID: 155943
           Summary: AX: Crash when AX trying to create element for an old
                    auto fill element
    Classification: Unclassified
           Product: WebKit
           Version: Safari 9
          Hardware: All
                OS: All
            Status: NEW
          Keywords: InRadar
          Severity: Normal
          Priority: P2
         Component: Accessibility
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: cfleizach at apple.com
                CC: webkit-bug-importer at group.apple.com

AX code can access an auto fill element that is still there as a Node, but has no renderer, and then add it to its child list as an empty refPtr

Thread 0 Crashed:: Dispatch queue: com.apple.main-thread
0   com.apple.WebCore                 0x00007fff9d11a403 WebCore::AccessibilityRenderObject::addChildren() + 355
1   com.apple.WebCore                 0x00007fff9d108c52 WebCore::AccessibilityObject::updateChildrenIfNecessary() + 66
2   com.apple.WebCore                 0x00007fff9d10460d WebCore::AccessibilityObject::updateBackingStore() + 77
3   com.apple.WebCore                 0x00007fff9dea6dfd -[WebAccessibilityObjectWrapperBase updateObjectBackingStore] + 61
4   com.apple.WebCore                 0x00007fff9deb6ff7 -[WebAccessibilityObjectWrapper accessibilityIsIgnored] + 23
5   com.apple.AppKit                  0x00007fff93d5adbe NSAccessibilityEntryPointIsAccessibilityElement + 231
6   com.apple.AppKit                  0x00007fff93dc5101 NSAccessibilityPostNotificationForObservedElementWithUserInfo + 215
7   com.apple.WebCore                 0x00007fff9d18ee7f WebCore::AXObjectCache::postPlatformNotification(WebCore::AccessibilityObject*, 

<rdar://problem/25350155>

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.webkit.org/pipermail/webkit-unassigned/attachments/20160328/c07b77ce/attachment-0001.html>