[Webkit-unassigned] [Bug 157830] New: AX: Crash when backspacing in number field with spin button

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=157830

            Bug ID: 157830
           Summary: AX: Crash when backspacing in number field with spin
                    button
    Classification: Unclassified
           Product: WebKit
           Version: Safari 9
          Hardware: All
                OS: All
            Status: NEW
          Keywords: InRadar
          Severity: Normal
          Priority: P2
         Component: Accessibility
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: cfleizach at apple.com
                CC: webkit-bug-importer at group.apple.com

Backspacing repeatedly with VoiceOver on in an input type="number" will eventually crash

Thread 0 Crashed:: Dispatch queue: com.apple.main-thread
0   com.apple.WebCore                 0x00007fff94f6312a WebCore::AXObjectCache::platformGenerateAXID() const + 10
1   com.apple.WebCore                 0x00007fff94f62e3b WebCore::AXObjectCache::getOrCreate(WebCore::AccessibilityRole) + 363
2   com.apple.WebCore                 0x00007fff94f0a816 WebCore::AccessibilitySpinButton::addChildren() + 38
3   com.apple.WebCore                 0x00007fff94ef63c2 WebCore::AccessibilityObject::updateChildrenIfNecessary() + 66
4   com.apple.WebCore                 0x00007fff94ef084d WebCore::AccessibilityObject::updateBackingStore() + 77
5   com.apple.WebCore                 0x00007fff95ad83ed -[WebAccessibilityObjectWrapperBase updateObjectBackingStore] + 61
6   com.apple.WebCore                 0x00007fff95ae1f47 -[WebAccessibilityObjectWrapper accessibilityAttributeValue:] + 39
7   com.apple.AppKit                  0x00007fff8b33d164 NSAccessibilityGetObjectForAttributeUsingLegacyAPI + 392
8   com.apple.AppKit                  0x00007fff8b33b7d8 _NSAccessibilityEntryPointValueForAttribute + 1879
9   com.apple.AppKit                  0x00007fff8bc41ca4 -[NSObject(NSRemoteUIElementAccessibility) accessibilityPresenterProcessIdentifier] + 111
10  com.apple.AppKit                  0x00007fff8b468ef0 NSAccessibilityCreateAXUIElementRef + 883
11  com.apple.AppKit                  0x00007fff8b6d3659 ConvertOutgoingValue + 1733
12  com.apple.AppKit                  0x00007fff8b6d3052 ConvertOutgoingValue + 190
13  com.apple.AppKit                  0x00007fff8b6d4c12 CopyAttributeValues + 289
14  com.apple.HIServices              0x00007fff89f86018 _AXXMIGCopyAttributeValues + 308
15  com.apple.HIServices              0x00007fff89f8ee37 _XCopyAttributeValues + 512
16  com.apple.HIServices              0x00007fff89f68dad mshMIGPerform + 199
17  com.apple.CoreFoundation          0x00007fff83324839 __CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE1_PERFORM_FUNCTION__ + 41
18  com.apple.CoreFoundation          0x00007fff833247a9 __CFRunLoopDoSource1 + 473
19  com.apple.CoreFoundation          0x00007fff83315e1b __CFRunLoopRun + 2171
20  com.apple.CoreFoundation          0x00007fff83315338 CFRunLoopRunSpecific + 296
21  com.apple.HIToolbox               0x00007fff829f4935 RunCurrentEventLoopInMode + 235
22  com.apple.HIToolbox               0x00007fff829f476f ReceiveNextEventCommon + 432
23  com.apple.HIToolbox               0x00007fff829f45af _BlockUntilNextEventMatchingListInModeWithFilter + 71
24  com.apple.AppKit                  0x00007fff8b31f0ee _DPSNextEvent + 1067
25  com.apple.AppKit                  0x00007fff8b6eb943 -[NSApplication _nextEventMatchingEventMask:untilDate:inMode:dequeue:] + 454
26  com.apple.AppKit                  0x00007fff8b314fc8 -[NSApplication run] + 682
27  com.apple.AppKit                  0x00007fff8b297520 NSApplicationMain + 1176
28  libxpc.dylib                      0x00007fff944aff6c _xpc_objc_main + 793
29  libxpc.dylib                      0x00007fff944b16bb xpc_main + 494
30  com.apple.WebKit.WebContent       0x0000000101d90b4a 0x101d90000 + 2890
31  libdyld.dylib                     0x00007fff86b8c5ad start + 1




<rdar://problem/24458212>

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.webkit.org/pipermail/webkit-unassigned/attachments/20160518/092bf58c/attachment-0001.html>