Title: [216980] trunk
- Revision
- 216980
- Author
- n_w...@apple.com
- Date
- 2017-05-17 10:34:27 -0700 (Wed, 17 May 2017)
Log Message
ASSERTION FAILED in WebCore::AccessibilityNodeObject::insertChild()
https://bugs.webkit.org/show_bug.cgi?id=171927
<rdar://problem/32109781>
Reviewed by Chris Fleizach.
Source/WebCore:
The nextSibling() logic might include the continuation sibling that's not
the child of the current renderer. Make sure we only insert the valid child.
Test: accessibility/insert-children-assert.html
* accessibility/AccessibilityObject.cpp:
(WebCore::AccessibilityObject::setIsIgnoredFromParentDataForChild):
* accessibility/AccessibilityRenderObject.cpp:
(WebCore::AccessibilityRenderObject::nextSibling):
LayoutTests:
* accessibility/insert-children-assert-expected.txt: Added.
* accessibility/insert-children-assert.html: Added.
Modified Paths
Added Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (216979 => 216980)
--- trunk/LayoutTests/ChangeLog 2017-05-17 17:23:20 UTC (rev 216979)
+++ trunk/LayoutTests/ChangeLog 2017-05-17 17:34:27 UTC (rev 216980)
@@ -1,3 +1,14 @@
+2017-05-17 Nan Wang <n_w...@apple.com>
+
+ ASSERTION FAILED in WebCore::AccessibilityNodeObject::insertChild()
+ https://bugs.webkit.org/show_bug.cgi?id=171927
+ <rdar://problem/32109781>
+
+ Reviewed by Chris Fleizach.
+
+ * accessibility/insert-children-assert-expected.txt: Added.
+ * accessibility/insert-children-assert.html: Added.
+
2017-05-17 Chris Dumez <cdu...@apple.com>
Import Notification tests from web-platform-tests
Added: trunk/LayoutTests/accessibility/insert-children-assert-expected.txt (0 => 216980)
--- trunk/LayoutTests/accessibility/insert-children-assert-expected.txt (rev 0)
+++ trunk/LayoutTests/accessibility/insert-children-assert-expected.txt 2017-05-17 17:34:27 UTC (rev 216980)
@@ -0,0 +1,11 @@
+ab
+c
+de
+This tests that we only insert valid children when building ax tree.
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS valueOccuranceInElementTree(content, value) is 1
+PASS valueOccuranceInElementTree(content, value) is 1
+
Added: trunk/LayoutTests/accessibility/insert-children-assert.html (0 => 216980)
--- trunk/LayoutTests/accessibility/insert-children-assert.html (rev 0)
+++ trunk/LayoutTests/accessibility/insert-children-assert.html 2017-05-17 17:34:27 UTC (rev 216980)
@@ -0,0 +1,73 @@
+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<script src=""
+<script src=""
+<script>
+var successfullyParsed = false;
+</script>
+</head>
+<style>
+body {
+ font-family: ahem;
+ -webkit-font-smoothing: none;
+}
+</style>
+<body id="body">
+<div id="content" aria-label="test">
+<summary>a<span>b<div>c</div>d</span>e</summary>
+</div>
+
+<p id="description"></p>
+<div id="console"></div>
+
+<script>
+ description("This tests that we only insert valid children when building ax tree.");
+
+ if ("webkitRequestFullScreen" in Element.prototype) {
+ if (window.testRunner)
+ testRunner.waitUntilDone();
+ var content = accessibilityController.accessibleElementById("content");
+ var value = "AXValue: d";
+ document.body.offsetTop;
+ var span = document.getElementsByTagName('span')[0];
+
+ var fullscreenChangeEvent = function(event) {
+ if (document.webkitIsFullScreen) {
+ setTimeout(function () {
+ document.webkitCancelFullScreen();
+ }, 0)
+ } else {
+ if (window.testRunner)
+ testRunner.notifyDone();
+ }
+ shouldBe("valueOccuranceInElementTree(content, value)", "1");
+ };
+
+ document.addEventListener('webkitfullscreenchange', fullscreenChangeEvent);
+
+ document.addEventListener('keydown', function () {
+ span.webkitRequestFullScreen();
+ });
+
+ shouldBe("valueOccuranceInElementTree(content, value)", "1");
+ if (window.eventSender)
+ eventSender.keyDown('a');
+
+ function valueOccuranceInElementTree(element, value) {
+ if (!element) {
+ return 0;
+ }
+ var count = 0;
+ if (element.stringValue == value)
+ count++;
+ var childrenCount = element.childrenCount;
+ for (var k = 0; k < childrenCount; k++)
+ count += valueOccuranceInElementTree(element.childAtIndex(k), value);
+ return count;
+ }
+ }
+ successfullyParsed = true;
+</script>
+</body>
+</html>
Modified: trunk/Source/WebCore/ChangeLog (216979 => 216980)
--- trunk/Source/WebCore/ChangeLog 2017-05-17 17:23:20 UTC (rev 216979)
+++ trunk/Source/WebCore/ChangeLog 2017-05-17 17:34:27 UTC (rev 216980)
@@ -1,3 +1,21 @@
+2017-05-17 Nan Wang <n_w...@apple.com>
+
+ ASSERTION FAILED in WebCore::AccessibilityNodeObject::insertChild()
+ https://bugs.webkit.org/show_bug.cgi?id=171927
+ <rdar://problem/32109781>
+
+ Reviewed by Chris Fleizach.
+
+ The nextSibling() logic might include the continuation sibling that's not
+ the child of the current renderer. Make sure we only insert the valid child.
+
+ Test: accessibility/insert-children-assert.html
+
+ * accessibility/AccessibilityObject.cpp:
+ (WebCore::AccessibilityObject::setIsIgnoredFromParentDataForChild):
+ * accessibility/AccessibilityRenderObject.cpp:
+ (WebCore::AccessibilityRenderObject::nextSibling):
+
2017-05-17 Ryosuke Niwa <rn...@webkit.org>
getElementById can return a wrong elemnt when a matching element is removed during beforeload event
Modified: trunk/Source/WebCore/accessibility/AccessibilityObject.cpp (216979 => 216980)
--- trunk/Source/WebCore/accessibility/AccessibilityObject.cpp 2017-05-17 17:23:20 UTC (rev 216979)
+++ trunk/Source/WebCore/accessibility/AccessibilityObject.cpp 2017-05-17 17:34:27 UTC (rev 216980)
@@ -3315,9 +3315,14 @@
void AccessibilityObject::setIsIgnoredFromParentDataForChild(AccessibilityObject* child)
{
- if (!child || child->parentObject() != this)
+ if (!child)
return;
+ if (child->parentObject() != this) {
+ child->clearIsIgnoredFromParentData();
+ return;
+ }
+
AccessibilityIsIgnoredFromParentData result = AccessibilityIsIgnoredFromParentData(this);
if (!m_isIgnoredFromParentData.isNull()) {
result.isARIAHidden = m_isIgnoredFromParentData.isARIAHidden || equalLettersIgnoringASCIICase(child->getAttribute(aria_hiddenAttr), "true");
Modified: trunk/Source/WebCore/accessibility/AccessibilityRenderObject.cpp (216979 => 216980)
--- trunk/Source/WebCore/accessibility/AccessibilityRenderObject.cpp 2017-05-17 17:23:20 UTC (rev 216979)
+++ trunk/Source/WebCore/accessibility/AccessibilityRenderObject.cpp 2017-05-17 17:34:27 UTC (rev 216980)
@@ -410,7 +410,12 @@
if (!nextSibling)
return nullptr;
- return axObjectCache()->getOrCreate(nextSibling);
+ // Make sure next sibling has the same parent.
+ AccessibilityObject* nextObj = axObjectCache()->getOrCreate(nextSibling);
+ if (nextObj && nextObj->parentObject() != this->parentObject())
+ return nullptr;
+
+ return nextObj;
}
static RenderBoxModelObject* nextContinuation(RenderObject& renderer)
_______________________________________________
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes
