[Webkit-unassigned] [Bug 175340] AX: crash at WebCore::AccessibilityObject::supportsARIALiveRegion() const + 24

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=175340

--- Comment #19 from chris fleizach <cfleizach at apple.com> ---
(In reply to Nan Wang from comment #17)
> (In reply to zalan from comment #16)
> > Comment on attachment 317763 [details]
> > patch
> > 
> > If it's about repareting, then this change is incorrect (it's incorrect for
> > other reasons as well)
> 
> Thanks for the comment. 
> I have figured out the issue. So like you said, we are notifying
> accessibility on childrenChanged() correctly when objects being
> inserted/removed. I think this particular case is that when a svg image
> being destroyed we didn't remove the corresponding ax object correctly, and
> accessing the stale object then leads to a crash.

That's promising. It may finally resolve

<rdar://problem/32188382> com.apple.WebKit.WebContent at WebCore::AccessibilityRenderObject::remoteSVGRootElement const + 32

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20170810/5e44ef33/attachment.html>