[webkit-changes] [216522] branches/safari-603-branch

Tue, 09 May 2017 11:05:44 -0700

Title: [216522] branches/safari-603-branch

Diff

Modified: branches/safari-603-branch/LayoutTests/ChangeLog (216521 => 216522)


--- branches/safari-603-branch/LayoutTests/ChangeLog	2017-05-09 18:05:07 UTC (rev 216521)
+++ branches/safari-603-branch/LayoutTests/ChangeLog	2017-05-09 18:05:11 UTC (rev 216522)
@@ -1,3 +1,17 @@
+2017-05-09  Matthew Hanson  <[email protected]>
+
+        Cherry-pick r215971. rdar://problem/31971140
+
+    2017-04-28  Per Arne Vollan  <[email protected]>
+
+            Crash under WebCore::AccessibilityRenderObject::handleAriaExpandedChanged().
+            https://bugs.webkit.org/show_bug.cgi?id=171427
+
+            Reviewed by Brent Fulgham.
+
+            * accessibility/accessibility-crash-setattribute-expected.txt: Added.
+            * accessibility/accessibility-crash-setattribute.html: Added.
+
 2017-05-03  Ryan Haddad  <[email protected]>
 
         Unreviewed test gardening.

Added: branches/safari-603-branch/LayoutTests/accessibility/accessibility-crash-setattribute-expected.txt (0 => 216522)


--- branches/safari-603-branch/LayoutTests/accessibility/accessibility-crash-setattribute-expected.txt	                        (rev 0)
+++ branches/safari-603-branch/LayoutTests/accessibility/accessibility-crash-setattribute-expected.txt	2017-05-09 18:05:11 UTC (rev 216522)
@@ -0,0 +1,2 @@
+PASS if no crash.  
+

Added: branches/safari-603-branch/LayoutTests/accessibility/accessibility-crash-setattribute.html (0 => 216522)


--- branches/safari-603-branch/LayoutTests/accessibility/accessibility-crash-setattribute.html	                        (rev 0)
+++ branches/safari-603-branch/LayoutTests/accessibility/accessibility-crash-setattribute.html	2017-05-09 18:05:11 UTC (rev 216522)
@@ -0,0 +1,28 @@
+<!DOCTYPE HTML>
+<html>
+<style>
+    #div { visibility: collapse }
+</style>
+<body>
+PASS if no crash.
+<script>
+    if (window.accessibilityController) {
+        var largeRange = accessibilityController.accessibleElementById("largeRange");
+    }
+    if (window.testRunner) {
+        testRunner.dumpAsText();
+    }
+    function eventhandler() {
+        document.execCommand("bold", false);
+        img.style.removeProperty("-webkit-appearance");
+        img.setAttribute("aria-expanded", "false");
+    }
+</script>
+<input id="largeRange" max="100" min="0" type="range" value="50">
+<div id="div">
+    <dl>
+        <canvas>aaa</canvas>
+        <img id="img" src="" style="-webkit-appearance: relevancy-level-indicator;" _onerror_="eventhandler()"></img>
+    </dl>
+</div>
+</body>

Modified: branches/safari-603-branch/Source/WebCore/ChangeLog (216521 => 216522)


--- branches/safari-603-branch/Source/WebCore/ChangeLog	2017-05-09 18:05:07 UTC (rev 216521)
+++ branches/safari-603-branch/Source/WebCore/ChangeLog	2017-05-09 18:05:11 UTC (rev 216522)
@@ -1,5 +1,26 @@
 2017-05-09  Matthew Hanson  <[email protected]>
 
+        Cherry-pick r215971. rdar://problem/31971140
+
+    2017-04-28  Per Arne Vollan  <[email protected]>
+
+            Crash under WebCore::AccessibilityRenderObject::handleAriaExpandedChanged().
+            https://bugs.webkit.org/show_bug.cgi?id=171427
+            rdar://problem/31863417
+
+            Reviewed by Brent Fulgham.
+
+            The AccessibilityRenderObject object might delete itself in handleAriaExpandedChanged() under the call
+            to the parentObject() method. This will cause a crash when accessing the object later in this method.
+            Protect the current object while executing arbitrary event code.
+
+            Test: accessibility/accessibility-crash-setattribute.html
+
+            * accessibility/AccessibilityRenderObject.cpp:
+            (WebCore::AccessibilityRenderObject::handleAriaExpandedChanged):
+
+2017-05-09  Matthew Hanson  <[email protected]>
+
         Cherry-pick r215528. rdar://problem/31971331
 
     2017-04-19  Joseph Pecoraro  <[email protected]>

Modified: branches/safari-603-branch/Source/WebCore/accessibility/AccessibilityRenderObject.cpp (216521 => 216522)


--- branches/safari-603-branch/Source/WebCore/accessibility/AccessibilityRenderObject.cpp	2017-05-09 18:05:07 UTC (rev 216521)
+++ branches/safari-603-branch/Source/WebCore/accessibility/AccessibilityRenderObject.cpp	2017-05-09 18:05:11 UTC (rev 216522)
@@ -2441,6 +2441,9 @@
 
 void AccessibilityRenderObject::handleAriaExpandedChanged()
 {
+    // This object might be deleted under the call to the parentObject() method.
+    auto protectedThis = makeRef(*this);
+    
     // Find if a parent of this object should handle aria-expanded changes.
     AccessibilityObject* containerParent = this->parentObject();
     while (containerParent) {

_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes

Reply via email to