<html>
<head>
<base href="https://bugs.webkit.org/" />
</head>
<body><span class="vcard"><a class="email" href="mailto:mario@webkit.org" title="Mario Sanchez Prada <mario@webkit.org>"> <span class="fn">Mario Sanchez Prada</span></a>
</span> changed
<a class="bz_bug_link
bz_status_NEW "
title="NEW - Layout Test accessibility/win/linked-elements.html is crashing on win debug"
href="https://bugs.webkit.org/show_bug.cgi?id=150944">bug 150944</a>
<br>
<table border="1" cellspacing="0" cellpadding="8">
<tr>
<th>What</th>
<th>Removed</th>
<th>Added</th>
</tr>
<tr>
<td style="text-align:right;">Attachment #264933 Flags</td>
<td>
</td>
<td>review?
</td>
</tr></table>
<p>
<div>
<b><a class="bz_bug_link
bz_status_NEW "
title="NEW - Layout Test accessibility/win/linked-elements.html is crashing on win debug"
href="https://bugs.webkit.org/show_bug.cgi?id=150944#c5">Comment # 5</a>
on <a class="bz_bug_link
bz_status_NEW "
title="NEW - Layout Test accessibility/win/linked-elements.html is crashing on win debug"
href="https://bugs.webkit.org/show_bug.cgi?id=150944">bug 150944</a>
from <span class="vcard"><a class="email" href="mailto:mario@webkit.org" title="Mario Sanchez Prada <mario@webkit.org>"> <span class="fn">Mario Sanchez Prada</span></a>
</span></b>
<pre>Created <span class=""><a href="attachment.cgi?id=264933&action=diff" name="attach_264933" title="Patch proposal">attachment 264933</a> <a href="attachment.cgi?id=264933&action=edit" title="Patch proposal">[details]</a></span>
Patch proposal
I was trying all sort of things to try to reproduce a similar crash in the GTK+ port but I couldn't so I proposing an speculative fix instead.
As I understand it, the problem is that now I moved those ASSERTs from AccessibilityNodeObject down to AccessibilityRenderObject, we are hitting those checks way more often for objects with an associated renderer since AccessibilityNodeObject::textUnderElement is not executed that often in this case.
So, the checks will probably need to be more precise to avoid being too paranoid, as for instance we don't need to worry about having an stable subtree when we are either going through a RenderText object or not in 'IncludeAllChildren' mode.
Looking at the backtrace, I can see that WebCore::AccessibilityRenderObject::nameForMSAA() calls textUnderElement() with the default mode, so I understand the attached patch should get rid of the crash in Win Debug bots.
Hope this helps</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are the assignee for the bug.</li>
</ul>
</body>
</html>