Title: [243894] trunk/Source/WebCore
- Revision
- 243894
- Author
- [email protected]
- Date
- 2019-04-04 13:31:34 -0700 (Thu, 04 Apr 2019)
Log Message
AX: Crash under WebCore::AccessibilityRenderObject::computeAccessibilityIsIgnored()
https://bugs.webkit.org/show_bug.cgi?id=196600
<rdar://problem/49572996>
Reviewed by Joanmarie Diggs.
Audit AX code to not dereference renderer before checking if it's null.
Not clear how to reproduce at this time.
* accessibility/AccessibilityRenderObject.cpp:
(WebCore::webAreaIsPresentational):
(WebCore::AccessibilityRenderObject::layoutCount const):
(WebCore::AccessibilityRenderObject::widget const):
Modified Paths
Diff
Modified: trunk/Source/WebCore/ChangeLog (243893 => 243894)
--- trunk/Source/WebCore/ChangeLog 2019-04-04 20:28:46 UTC (rev 243893)
+++ trunk/Source/WebCore/ChangeLog 2019-04-04 20:31:34 UTC (rev 243894)
@@ -1,3 +1,19 @@
+2019-04-04 Chris Fleizach <[email protected]>
+
+ AX: Crash under WebCore::AccessibilityRenderObject::computeAccessibilityIsIgnored()
+ https://bugs.webkit.org/show_bug.cgi?id=196600
+ <rdar://problem/49572996>
+
+ Reviewed by Joanmarie Diggs.
+
+ Audit AX code to not dereference renderer before checking if it's null.
+ Not clear how to reproduce at this time.
+
+ * accessibility/AccessibilityRenderObject.cpp:
+ (WebCore::webAreaIsPresentational):
+ (WebCore::AccessibilityRenderObject::layoutCount const):
+ (WebCore::AccessibilityRenderObject::widget const):
+
2019-04-04 Antti Koivisto <[email protected]>
Compute accurate regions for touch-action
Modified: trunk/Source/WebCore/accessibility/AccessibilityRenderObject.cpp (243893 => 243894)
--- trunk/Source/WebCore/accessibility/AccessibilityRenderObject.cpp 2019-04-04 20:28:46 UTC (rev 243893)
+++ trunk/Source/WebCore/accessibility/AccessibilityRenderObject.cpp 2019-04-04 20:31:34 UTC (rev 243894)
@@ -1156,7 +1156,7 @@
static bool webAreaIsPresentational(RenderObject* renderer)
{
- if (!is<RenderView>(*renderer))
+ if (!renderer || !is<RenderView>(*renderer))
return false;
if (auto ownerElement = renderer->document().ownerElement())
@@ -1445,7 +1445,7 @@
int AccessibilityRenderObject::layoutCount() const
{
- if (!is<RenderView>(*m_renderer))
+ if (!m_renderer || !is<RenderView>(*m_renderer))
return 0;
return downcast<RenderView>(*m_renderer).frameView().layoutContext().layoutCount();
}
@@ -1816,7 +1816,7 @@
Widget* AccessibilityRenderObject::widget() const
{
- if (!is<RenderWidget>(*m_renderer))
+ if (!m_renderer || !is<RenderWidget>(*m_renderer))
return nullptr;
return downcast<RenderWidget>(*m_renderer).widget();
}
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
