Bug 44136 - Crash in DumpRenderTree!notificationListenerProc when running plugins/access-after-page-destroyed.html
Summary: Crash in DumpRenderTree!notificationListenerProc when running plugins/access-...
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: Tools / Tests (show other bugs)
Version: 528+ (Nightly build)
Hardware: PC Windows XP
: P2 Normal
Assignee: Nobody
URL: http://build.webkit.org/results/Windo...
Keywords: InRadar, LayoutTestFailure, PlatformOnly
Depends on:
Blocks:
 
Reported: 2010-08-17 16:05 PDT by Adam Roben (:aroben)
Modified: 2010-10-01 16:33 PDT (History)
2 users (show)

See Also:

Attachments
Don't assume AccessibleObjectFromEvent succeeds (1.63 KB, patch)
2010-10-01 11:44 PDT, Adam Roben (:aroben) 		sam: review+
Details | Formatted Diff | Diff
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Adam Roben (:aroben) 2010-08-17 16:05:29 PDT 
plugins/access-after-page-destroyed.html is crashing on the bots. The crash logs implicate DumpRenderTree!notificationListenerProc (see <http://build.webkit.org/results/Windows%20Release%20(Tests)/r65540%20(2834)/CrashLog_0e08_2010-08-17_15-52-59-764.txt>).
Comment 1 Adam Roben (:aroben) 2010-08-17 16:10:10 PDT 
<rdar://problem/8321684>
Comment 2 Adam Roben (:aroben) 2010-08-18 08:29:58 PDT 
Looks like the crash is preceded by an assertion in debug builds: <http://build.webkit.org/results/Windows%20Debug%20(Tests)/r65606%20(18248)/CrashLog_0538_2010-08-18_07-01-47-171.txt>

The failing assertion is:

HRESULT hr = AccessibleObjectFromEvent(hwnd, idObject, idChild, &parentObject, &vChild);
ASSERT(SUCCEEDED(hr));

Presumably we crash later because vChild is still null.
Comment 3 Adam Roben (:aroben) 2010-10-01 11:44:40 PDT 
Created attachment 69491 [details]
Don't assume AccessibleObjectFromEvent succeeds
Comment 4 Adam Roben (:aroben) 2010-10-01 11:57:07 PDT 
Committed r68907: <http://trac.webkit.org/changeset/68907>
Comment 5 Jon Honeycutt 2010-10-01 16:22:19 PDT 
Do you know which event we're receiving that AccessibleObjectFromEvent fails on?
Comment 6 Jon Honeycutt 2010-10-01 16:33:51 PDT 
I think the bug here may be that AccessibilityController::resetToConsistentState() is not unhooking the "all events" hook set in AccessibilityController::addNotificationListener().