Title: [219081] trunk
- Revision
- 219081
- Author
- [email protected]
- Date
- 2017-07-03 11:35:07 -0700 (Mon, 03 Jul 2017)
Log Message
REGRESSION(r218910): Crash inside textMarkerDataForFirstPositionInTextControl
https://bugs.webkit.org/show_bug.cgi?id=174077
<rdar://problem/33083972>
Reviewed by Chris Fleizach.
Source/WebCore:
The bug was caused by textMarkerDataForFirstPositionInTextControl assuming that
there is always a root editable element (a.k.a. editing host) in the text control.
When the text control is readonly or disabled, this is not the case.
Fixed the bug by adding an early exit when there is no editing host.
Test: accessibility/mac/input-type-change-crash.html
* accessibility/AXObjectCache.cpp:
(WebCore::AXObjectCache::textMarkerDataForFirstPositionInTextControl):
LayoutTests:
Added a regression test for changing the input element's type during editing.
* accessibility/mac/input-type-change-crash-expected.txt: Added.
* accessibility/mac/input-type-change-crash.html: Added.
Modified Paths
Added Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (219080 => 219081)
--- trunk/LayoutTests/ChangeLog 2017-07-03 18:31:02 UTC (rev 219080)
+++ trunk/LayoutTests/ChangeLog 2017-07-03 18:35:07 UTC (rev 219081)
@@ -1,3 +1,16 @@
+2017-07-02 Ryosuke Niwa <[email protected]>
+
+ REGRESSION(r218910): Crash inside textMarkerDataForFirstPositionInTextControl
+ https://bugs.webkit.org/show_bug.cgi?id=174077
+ <rdar://problem/33083972>
+
+ Reviewed by Chris Fleizach.
+
+ Added a regression test for changing the input element's type during editing.
+
+ * accessibility/mac/input-type-change-crash-expected.txt: Added.
+ * accessibility/mac/input-type-change-crash.html: Added.
+
2017-07-03 Saam Barati <[email protected]>
Unreviewed. Mark workers/bomb.html as flaky.
Added: trunk/LayoutTests/accessibility/mac/input-type-change-crash-expected.txt (0 => 219081)
--- trunk/LayoutTests/accessibility/mac/input-type-change-crash-expected.txt (rev 0)
+++ trunk/LayoutTests/accessibility/mac/input-type-change-crash-expected.txt 2017-07-03 18:35:07 UTC (rev 219081)
@@ -0,0 +1,10 @@
+This tests setting the value to a readonly or disabled text field which was previously editable
+
+AXTextStateChangeType=1 AXTextChangeValues=[{"AXTextChangeValue":"a","AXTextEditType":3}]
+AXTextStateChangeType=1 AXTextChangeValues=[{"AXTextChangeValue":"a","AXTextEditType":1},{"AXTextChangeValue":"hello","AXTextEditType":2}]
+AXTextStateChangeType=1 AXTextChangeValues=[{"AXTextChangeValue":"b","AXTextEditType":3}]
+AXTextStateChangeType=1 AXTextChangeValues=[{"AXTextChangeValue":"hellob","AXTextEditType":1},{"AXTextChangeValue":"world","AXTextEditType":2}]
+AXTextStateChangeType=1 AXTextChangeValues=[{"AXTextChangeValue":"c","AXTextEditType":3}]
+AXTextStateChangeType=1 AXTextChangeValues=[{"AXTextChangeValue":"worldc","AXTextEditType":1},{"AXTextChangeValue":"WebKit","AXTextEditType":2}]
+AXTextStateChangeType=1 AXTextChangeValues=[{"AXTextChangeValue":"d","AXTextEditType":3}]
+
Added: trunk/LayoutTests/accessibility/mac/input-type-change-crash.html (0 => 219081)
--- trunk/LayoutTests/accessibility/mac/input-type-change-crash.html (rev 0)
+++ trunk/LayoutTests/accessibility/mac/input-type-change-crash.html 2017-07-03 18:35:07 UTC (rev 219081)
@@ -0,0 +1,60 @@
+<!DOCTYPE html>
+<html>
+<body>
+<p>This tests setting the value to a readonly or disabled text field which was previously editable</p>
+<pre id="log"></pre>
+<input type="text">
+<script>
+
+if (!window.accessibilityController)
+ document.write('This test requires accessibilityController');
+else {
+ testRunner.dumpAsText();
+ testRunner.waitUntilDone();
+ accessibilityController.enableEnhancedAccessibility(true);
+
+ function sortByKey(unsortedObject) {
+ const sortedObject = {};
+ for (const key of Object.keys(unsortedObject).sort())
+ sortedObject[key] = unsortedObject[key];
+ return sortedObject;
+ }
+
+ const webArea = accessibilityController.rootElement.childAtIndex(0);
+ const notifications = [];
+ webArea.addNotificationListener((notification, userInfo) => {
+ if (notification == 'AXLoadComplete') {
+ webArea.removeNotificationListener();
+ testRunner.notifyDone();
+ return;
+ }
+ if (notification != 'AXValueChanged')
+ return;
+
+ document.getElementById('log').textContent
+ += `AXTextStateChangeType=${userInfo['AXTextStateChangeType']}`
+ + ` AXTextChangeValues=${JSON.stringify(userInfo['AXTextChangeValues'].map(object => sortByKey(object)))}\n`
+ });
+
+ const input = document.querySelector('input');
+ input.focus();
+ eventSender.keyDown('a');
+ input.value = 'hello';
+ eventSender.keyDown('b');
+ input.readOnly = true;
+ internals.updateLayoutIgnorePendingStylesheetsAndRunPostLayoutTasks();
+ input.value = 'world';
+ input.readOnly = false;
+ internals.updateLayoutIgnorePendingStylesheetsAndRunPostLayoutTasks();
+ eventSender.keyDown('c');
+ input.disabled = true;
+ internals.updateLayoutIgnorePendingStylesheetsAndRunPostLayoutTasks();
+ input.value = 'WebKit';
+ input.disabled = false;
+ internals.updateLayoutIgnorePendingStylesheetsAndRunPostLayoutTasks();
+ eventSender.keyDown('d');
+}
+
+</script>
+</body>
+</html>
Modified: trunk/Source/WebCore/ChangeLog (219080 => 219081)
--- trunk/Source/WebCore/ChangeLog 2017-07-03 18:31:02 UTC (rev 219080)
+++ trunk/Source/WebCore/ChangeLog 2017-07-03 18:35:07 UTC (rev 219081)
@@ -1,3 +1,22 @@
+2017-07-02 Ryosuke Niwa <[email protected]>
+
+ REGRESSION(r218910): Crash inside textMarkerDataForFirstPositionInTextControl
+ https://bugs.webkit.org/show_bug.cgi?id=174077
+ <rdar://problem/33083972>
+
+ Reviewed by Chris Fleizach.
+
+ The bug was caused by textMarkerDataForFirstPositionInTextControl assuming that
+ there is always a root editable element (a.k.a. editing host) in the text control.
+ When the text control is readonly or disabled, this is not the case.
+
+ Fixed the bug by adding an early exit when there is no editing host.
+
+ Test: accessibility/mac/input-type-change-crash.html
+
+ * accessibility/AXObjectCache.cpp:
+ (WebCore::AXObjectCache::textMarkerDataForFirstPositionInTextControl):
+
2017-07-03 Devin Rousso <[email protected]>
Web Inspector: Support listing WebGL2 and WebGPU contexts
Modified: trunk/Source/WebCore/accessibility/AXObjectCache.cpp (219080 => 219081)
--- trunk/Source/WebCore/accessibility/AXObjectCache.cpp 2017-07-03 18:31:02 UTC (rev 219080)
+++ trunk/Source/WebCore/accessibility/AXObjectCache.cpp 2017-07-03 18:35:07 UTC (rev 219081)
@@ -2158,6 +2158,8 @@
if (!firstChild)
firstChild = innerTextElement;
ContainerNode* editingHost = highestEditableRoot(firstPosition);
+ if (!editingHost) // textControl is no longer editable. e.g. readonly or disabled.
+ return std::nullopt;
AXObjectCache* cache = textControl.document().axObjectCache();
RefPtr<AccessibilityObject> obj = cache->getOrCreate(editingHost);
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
