Title: [219661] trunk
- Revision
- 219661
- Author
- n_w...@apple.com
- Date
- 2017-07-19 12:18:40 -0700 (Wed, 19 Jul 2017)
Log Message
AX: Web page reloaded when a node is labelling multiple childnodes
https://bugs.webkit.org/show_bug.cgi?id=174655
Reviewed by Chris Fleizach.
Source/WebCore:
When we are asking for the aria-labelledby attribute of a node and its
sibling is also labelled by the same node, we get into an infinite loop
in textUnderElement since we only ignore one child. Added checks for
siblings to avoid such loop.
Test: accessibility/mac/aria-labelledby-multiple-child-crash.html
* accessibility/AccessibilityNodeObject.cpp:
(WebCore::AccessibilityNodeObject::textUnderElement):
LayoutTests:
* accessibility/mac/aria-labelledby-multiple-child-crash-expected.txt: Added.
* accessibility/mac/aria-labelledby-multiple-child-crash.html: Added.
Modified Paths
Added Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (219660 => 219661)
--- trunk/LayoutTests/ChangeLog 2017-07-19 18:16:35 UTC (rev 219660)
+++ trunk/LayoutTests/ChangeLog 2017-07-19 19:18:40 UTC (rev 219661)
@@ -1,3 +1,13 @@
+2017-07-19 Nan Wang <n_w...@apple.com>
+
+ AX: Web page reloaded when a node is labelling multiple childnodes
+ https://bugs.webkit.org/show_bug.cgi?id=174655
+
+ Reviewed by Chris Fleizach.
+
+ * accessibility/mac/aria-labelledby-multiple-child-crash-expected.txt: Added.
+ * accessibility/mac/aria-labelledby-multiple-child-crash.html: Added.
+
2017-07-19 Chris Dumez <cdu...@apple.com>
Make cross-origin properties enumerable
Added: trunk/LayoutTests/accessibility/mac/aria-labelledby-multiple-child-crash-expected.txt (0 => 219661)
--- trunk/LayoutTests/accessibility/mac/aria-labelledby-multiple-child-crash-expected.txt (rev 0)
+++ trunk/LayoutTests/accessibility/mac/aria-labelledby-multiple-child-crash-expected.txt 2017-07-19 19:18:40 UTC (rev 219661)
@@ -0,0 +1,14 @@
+Header
+Header2
+Description text
+
+This tests that when a node is labelling multiple child nodes it won't cause crash.
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+AXDescription: Description text
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
Added: trunk/LayoutTests/accessibility/mac/aria-labelledby-multiple-child-crash.html (0 => 219661)
--- trunk/LayoutTests/accessibility/mac/aria-labelledby-multiple-child-crash.html (rev 0)
+++ trunk/LayoutTests/accessibility/mac/aria-labelledby-multiple-child-crash.html 2017-07-19 19:18:40 UTC (rev 219661)
@@ -0,0 +1,33 @@
+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<script src=""
+</head>
+<body id="body">
+
+<div id="hd">
+<div role="heading" id="heading" aria-level="7" aria-labelledby="hd">Header</div>
+<div role="heading" id="heading2" aria-level="7" aria-labelledby="hd">Header2</div>
+
+<p>Description text</p>
+</div>
+
+<p id="description"></p>
+<div id="console"></div>
+
+<script>
+
+ description("This tests that when a node is labelling multiple child nodes it won't cause crash.");
+
+ if (window.accessibilityController) {
+
+ var heading = accessibilityController.accessibleElementById("heading");
+ // Do not crash
+ debug(heading.description);
+ }
+
+</script>
+
+<script src=""
+</body>
+</html>
Modified: trunk/Source/WebCore/ChangeLog (219660 => 219661)
--- trunk/Source/WebCore/ChangeLog 2017-07-19 18:16:35 UTC (rev 219660)
+++ trunk/Source/WebCore/ChangeLog 2017-07-19 19:18:40 UTC (rev 219661)
@@ -1,3 +1,20 @@
+2017-07-19 Nan Wang <n_w...@apple.com>
+
+ AX: Web page reloaded when a node is labelling multiple childnodes
+ https://bugs.webkit.org/show_bug.cgi?id=174655
+
+ Reviewed by Chris Fleizach.
+
+ When we are asking for the aria-labelledby attribute of a node and its
+ sibling is also labelled by the same node, we get into an infinite loop
+ in textUnderElement since we only ignore one child. Added checks for
+ siblings to avoid such loop.
+
+ Test: accessibility/mac/aria-labelledby-multiple-child-crash.html
+
+ * accessibility/AccessibilityNodeObject.cpp:
+ (WebCore::AccessibilityNodeObject::textUnderElement):
+
2017-07-19 Andy Estes <aes...@apple.com>
Use a cast to work around clang's false -Wobjc-literal-conversion warnings
Modified: trunk/Source/WebCore/accessibility/AccessibilityNodeObject.cpp (219660 => 219661)
--- trunk/Source/WebCore/accessibility/AccessibilityNodeObject.cpp 2017-07-19 18:16:35 UTC (rev 219660)
+++ trunk/Source/WebCore/accessibility/AccessibilityNodeObject.cpp 2017-07-19 19:18:40 UTC (rev 219661)
@@ -1731,6 +1731,14 @@
continue;
if (is<AccessibilityNodeObject>(*child)) {
+ // We should ignore the child if it's labeled by this node.
+ // This could happen when this node labels multiple child nodes and we didn't
+ // skip in the above ignoredChildNode check.
+ Vector<Element*> labeledByElements;
+ downcast<AccessibilityNodeObject>(*child).ariaLabeledByElements(labeledByElements);
+ if (labeledByElements.contains(node))
+ continue;
+
Vector<AccessibilityText> textOrder;
downcast<AccessibilityNodeObject>(*child).alternativeText(textOrder);
if (textOrder.size() > 0 && textOrder[0].text.length()) {
_______________________________________________
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes
