[Webkit-unassigned] [Bug 175340] AX: crash at WebCore::AccessibilityObject::supportsARIALiveRegion() const + 24

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=175340

--- Comment #17 from Nan Wang <n_wang at apple.com> ---
(In reply to zalan from comment #16)
> Comment on attachment 317763 [details]
> patch
> 
> If it's about repareting, then this change is incorrect (it's incorrect for
> other reasons as well)

Thanks for the comment. 
I have figured out the issue. So like you said, we are notifying accessibility on childrenChanged() correctly when objects being inserted/removed. I think this particular case is that when a svg image being destroyed we didn't remove the corresponding ax object correctly, and accessing the stale object then leads to a crash.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20170810/2be939d3/attachment-0001.html>