[Webkit-unassigned] [Bug 235827] New: AX: AccessibilitySlider::inputElement should check if the renderer has become null

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=235827

            Bug ID: 235827
           Summary: AX: AccessibilitySlider::inputElement should check if
                    the renderer has become null
           Product: WebKit
           Version: WebKit Nightly Build
          Hardware: All
                OS: All
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: Accessibility
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: tyler_w at apple.com
                CC: andresg_22 at apple.com,
                    webkit-bug-importer at group.apple.com

After https://bugs.webkit.org/show_bug.cgi?id=235715, we no longer call the update version of children from logging. This has made accessibility/mac/spinbutton-valuedescription.html a constant failure in debug mode only, since the logging is trying to print an AX tree that is out of sync with the DOM. This test uses JS to remove an <input> renderer + node.

Exception Type:        EXC_BAD_ACCESS (SIGSEGV)
Exception Codes:       KERN_INVALID_ADDRESS at 0x000000000000003c

0   com.apple.WebCore                   0x00000001af545e0c WebCore::RenderObject::RenderObjectBitfields::isAnonymous() const + 12 (RenderObject.h:888)
1   com.apple.WebCore                   0x00000001af545dee WebCore::RenderObject::isAnonymous() const + 30 (RenderObject.h:391)
2   com.apple.WebCore                   0x00000001af530f0c WebCore::RenderObject::node() const + 28 (RenderObject.h:465)
3   com.apple.WebCore                   0x00000001afa53186 WebCore::AccessibilitySlider::inputElement() const + 38 (AccessibilitySlider.cpp:150)
4   com.apple.WebCore                   0x00000001afa53149 WebCore::AccessibilitySlider::getAttribute(WebCore::QualifiedName const&) const + 25 (AccessibilitySlider.cpp:108)
5   com.apple.WebCore                   0x00000001afa0e958 WebCore::AccessibilityObject::identifierAttribute() const + 72 (AccessibilityObject.cpp:2984)
6   com.apple.WebCore                   0x00000001af988ac1 WebCore::operator<<(WTF::TextStream&, WebCore::AXCoreObject const&) + 145 (AXLogger.cpp:487)
7   com.apple.WebCore                   0x00000001af9890af WebCore::AXLogger::add(WTF::TextStream&, WTF::RefPtr<WebCore::AXCoreObject, WTF::RawPtrTraits<WebCore::AXCoreObject>, WTF::DefaultRefDerefTraits<WebCore::AXCoreObject> > const&, bool) + 95 (AXLogger.cpp:100)
8   com.apple.WebCore                   0x00000001af989116 WebCore::AXLogger::add(WTF::TextStream&, WTF::RefPtr<WebCore::AXCoreObject, WTF::RawPtrTraits<WebCore::AXCoreObject>, WTF::DefaultRefDerefTraits<WebCore::AXCoreObject> > const&, bool) + 198 (AXLogger.cpp:104)
9   com.apple.WebCore                   0x00000001af989116 WebCore::AXLogger::add(WTF::TextStream&, WTF::RefPtr<WebCore::AXCoreObject, WTF::RawPtrTraits<WebCore::AXCoreObject>, WTF::DefaultRefDerefTraits<WebCore::AXCoreObject> > const&, bool) + 198 (AXLogger.cpp:104)
10  com.apple.WebCore                   0x00000001af989116 WebCore::AXLogger::add(WTF::TextStream&, WTF::RefPtr<WebCore::AXCoreObject, WTF::RawPtrTraits<WebCore::AXCoreObject>, WTF::DefaultRefDerefTraits<WebCore::AXCoreObject> > const&, bool) + 198 (AXLogger.cpp:104)
11  com.apple.WebCore                   0x00000001af98a044 WebCore::operator<<(WTF::TextStream&, WebCore::AXObjectCache&) + 164 (AXLogger.cpp:528)
12  com.apple.WebCore                   0x00000001af989f40 WebCore::AXLogger::log(WebCore::AXObjectCache&) + 80 (AXLogger.cpp:146)
13  com.apple.WebCore                   0x00000001af994ce0 WebCore::AXObjectCache::updateIsolatedTree(WTF::Vector<std::__1::pair<WTF::RefPtr<WebCore::AXCoreObject, WTF::RawPtrTraits<WebCore::AXCoreObject>, WTF::DefaultRefDerefTraits<WebCore::AXCoreObject> >, WebCore::AXObjectCache::AXNotification>, 0ul, WTF::CrashOnOverflow, 16ul, WTF::FastMalloc> const&) + 80 (AXObjectCache.cpp:3327)
14  com.apple.WebCore                   0x00000001af98d138 WebCore::AXObjectCache::notificationPostTimerFired() + 1032 (AXObjectCache.cpp:1150)


This logging is not enabled in release, so it's not a problem there.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20220128/f8ff5517/attachment-0001.htm>