Title: [258609] trunk
- Revision
- 258609
- Author
- [email protected]
- Date
- 2020-03-17 16:02:36 -0700 (Tue, 17 Mar 2020)
Log Message
AX: WebKit crashes with VO and keyboard support fails on encapsulated radio button components.
https://bugs.webkit.org/show_bug.cgi?id=208844
<rdar://problem/60252659>
Reviewed by Darin Adler.
Source/WebCore:
Test: accessibility/mac/crash-bounds-for-range.html
Don't access renderer if nil in getInlineBoxAndOffset.
* dom/Position.cpp:
(WebCore::Position::getInlineBoxAndOffset const):
LayoutTests:
* accessibility/mac/crash-bounds-for-range-expected.txt: Added.
* accessibility/mac/crash-bounds-for-range.html: Added.
Modified Paths
Added Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (258608 => 258609)
--- trunk/LayoutTests/ChangeLog 2020-03-17 22:56:11 UTC (rev 258608)
+++ trunk/LayoutTests/ChangeLog 2020-03-17 23:02:36 UTC (rev 258609)
@@ -1,3 +1,14 @@
+2020-03-17 Chris Fleizach <[email protected]>
+
+ AX: WebKit crashes with VO and keyboard support fails on encapsulated radio button components.
+ https://bugs.webkit.org/show_bug.cgi?id=208844
+ <rdar://problem/60252659>
+
+ Reviewed by Darin Adler.
+
+ * accessibility/mac/crash-bounds-for-range-expected.txt: Added.
+ * accessibility/mac/crash-bounds-for-range.html: Added.
+
2020-03-17 Jacob Uphoff <[email protected]>
[ macOS wk1 ] imported/w3c/web-platform-tests/html/semantics/embedded-content/media-elements/loading-the-media-resource/resource-selection-pointer-insert-text.html is flaky failing
Added: trunk/LayoutTests/accessibility/mac/crash-bounds-for-range-expected.txt (0 => 258609)
--- trunk/LayoutTests/accessibility/mac/crash-bounds-for-range-expected.txt (rev 0)
+++ trunk/LayoutTests/accessibility/mac/crash-bounds-for-range-expected.txt 2020-03-17 23:02:36 UTC (rev 258609)
@@ -0,0 +1,13 @@
+fake
+
+fake
+This test validates we don't crash asking for range for bounds when encountering a shadow dom element.
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS [object AccessibilityUIElement] is non-null.
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
Added: trunk/LayoutTests/accessibility/mac/crash-bounds-for-range.html (0 => 258609)
--- trunk/LayoutTests/accessibility/mac/crash-bounds-for-range.html (rev 0)
+++ trunk/LayoutTests/accessibility/mac/crash-bounds-for-range.html 2020-03-17 23:02:36 UTC (rev 258609)
@@ -0,0 +1,51 @@
+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<script src=""
+</head>
+<body id="body">
+
+<div><a href=""
+<form novalidate="">
+<fake-radio id="radio1" data-id="jawns_01" data-name="jawns" data-label="Gritty"></fake-radio>
+<fake-radio data-id="jawns_02" data-name="jawns" data-label="Wawa"></fake-radio>
+</form>
+<div><a href=""
+<script>
+customElements.define(
+"fake-radio",
+class FakeRadio extends HTMLElement {
+ constructor() {
+ super();
+ let shadow = this.attachShadow({ mode: "open" });
+ let radio = document.createElement("input");
+ let label = document.createElement("label");
+ label.innerText = this.dataset.label;
+ radio.id = this.dataset.id;
+ radio.type = "radio";
+ radio.name = this.dataset.name;
+ label.setAttribute("for", this.dataset.id);
+
+ shadow.appendChild(radio);
+ shadow.appendChild(label);
+ }});
+</script>
+
+
+
+<p id="description"></p>
+<div id="console"></div>
+
+<script>
+ description("This test validates we don't crash asking for range for bounds when encountering a shadow dom element.");
+
+ if (window.accessibilityController) {
+ var element = accessibilityController.accessibleElementById("jawns_01");
+ var bounds = element.boundsForRange(0, 6);
+ shouldBeNonNull(element);
+ }
+</script>
+<script src=""
+</body>
+</html>
+
Modified: trunk/Source/WebCore/ChangeLog (258608 => 258609)
--- trunk/Source/WebCore/ChangeLog 2020-03-17 22:56:11 UTC (rev 258608)
+++ trunk/Source/WebCore/ChangeLog 2020-03-17 23:02:36 UTC (rev 258609)
@@ -1,3 +1,18 @@
+2020-03-17 Chris Fleizach <[email protected]>
+
+ AX: WebKit crashes with VO and keyboard support fails on encapsulated radio button components.
+ https://bugs.webkit.org/show_bug.cgi?id=208844
+ <rdar://problem/60252659>
+
+ Reviewed by Darin Adler.
+
+ Test: accessibility/mac/crash-bounds-for-range.html
+
+ Don't access renderer if nil in getInlineBoxAndOffset.
+
+ * dom/Position.cpp:
+ (WebCore::Position::getInlineBoxAndOffset const):
+
2020-03-17 Eric Carlson <[email protected]>
TextTrackBase should validate language before setting m_validBCP47Language
Modified: trunk/Source/WebCore/dom/Position.cpp (258608 => 258609)
--- trunk/Source/WebCore/dom/Position.cpp 2020-03-17 22:56:11 UTC (rev 258608)
+++ trunk/Source/WebCore/dom/Position.cpp 2020-03-17 23:02:36 UTC (rev 258609)
@@ -1206,7 +1206,9 @@
{
caretOffset = deprecatedEditingOffset();
RenderObject* renderer = deprecatedNode()->renderer();
-
+ if (!renderer)
+ return;
+
if (renderer->isBR()) {
auto& lineBreakRenderer = downcast<RenderLineBreak>(*renderer);
lineBreakRenderer.ensureLineBoxes();
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
