Diff
Modified: trunk/LayoutTests/ChangeLog (290857 => 290858)
--- trunk/LayoutTests/ChangeLog 2022-03-05 01:44:20 UTC (rev 290857)
+++ trunk/LayoutTests/ChangeLog 2022-03-05 02:03:49 UTC (rev 290858)
@@ -1,3 +1,21 @@
+2022-03-04 Tyler Wilcock <[email protected]>
+
+ AX: [WebAccessibilityObjectWrapperMac AXAttributeStringSetFont] crashes when given a font with a nil postscript name, font family, or display name
+ https://bugs.webkit.org/show_bug.cgi?id=237373
+
+ Reviewed by Chris Fleizach and Andres Gonzalez.
+
+ * accessibility/resources/Litherum.svg: Added.
+ * accessibility/svg-font-face-expected.txt: Added.
+ * accessibility/svg-font-face.html: Added.
+ * platform/glib/TestExpectations: Skip new test.
+ * platform/ios/TestExpectations: Enable new test.
+ * platform/win/TestExpectations: Skip new test.
+
+ * platform/mac/accessibility/element-line-rects-and-text-expected.txt:
+ Before this patch, [WebAccessibilityObjectWrapperBase AXAttributeStringSetStyle] called the iOS
+ version of AXAttributeStringSetFont. This patch fixes this. The expectation for this test is updated as a result.
+
2022-03-04 Kate Cheney <[email protected]>
about:blank iframes do not always inherit parent CSP
Added: trunk/LayoutTests/accessibility/resources/Litherum.svg (0 => 290858)
--- trunk/LayoutTests/accessibility/resources/Litherum.svg (rev 0)
+++ trunk/LayoutTests/accessibility/resources/Litherum.svg 2022-03-05 02:03:49 UTC (rev 290858)
@@ -0,0 +1,12 @@
+<?xml version="1.0" standalone="no"?>
+<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd" >
+<svg xmlns="http://www.w3.org/2000/svg">
+<metadata></metadata>
+<defs>
+<font id="Litherum" horiz-adv-x="1024">
+<font-face units-per-em="14" ascent="14" descent="0"/>
+<glyph unicode="|" horiz-adv-x="14" d="M0 0v14h14v-14z"/>
+<glyph unicode="-" horiz-adv-x="266" d="M0 0v14h266v-14z"/>
+</font>
+</defs>
+</svg>
Added: trunk/LayoutTests/accessibility/svg-font-face-expected.txt (0 => 290858)
--- trunk/LayoutTests/accessibility/svg-font-face-expected.txt (rev 0)
+++ trunk/LayoutTests/accessibility/svg-font-face-expected.txt 2022-03-05 02:03:49 UTC (rev 290858)
@@ -0,0 +1,8 @@
+This test ensures that we don't crash when applying a custom SVG font to attributed strings.
+Getting attributed string for range (0, 9)
+PASS: Didn't crash.
+
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
Added: trunk/LayoutTests/accessibility/svg-font-face.html (0 => 290858)
--- trunk/LayoutTests/accessibility/svg-font-face.html (rev 0)
+++ trunk/LayoutTests/accessibility/svg-font-face.html 2022-03-05 02:03:49 UTC (rev 290858)
@@ -0,0 +1,35 @@
+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<script src=""
+<style>
+@font-face {
+ font-family: 'Litherum';
+ src: url("resources/Litherum.svg") format(svg);
+}
+* { font-family: 'Litherum'; }
+</style>
+</head>
+<body _onload_="runTest()">
+
+<input type="text" id="textfield" value="some word"></input>
+
+<script>
+ var output = "This test ensures that we don't crash when applying a custom SVG font to attributed strings.\n";
+
+ if (window.accessibilityController)
+ window.jsTestIsAsync = true;
+
+ function runTest() {
+ if (window.accessibilityController) {
+ const textField = accessibilityController.accessibleElementById("textfield");
+ output += `Getting attributed string for range (0, 9)\n`;
+ const attributedString = textField.attributedStringForRange(0, 9);
+ output += "PASS: Didn't crash.\n";
+ debug(output);
+ finishJSTest();
+ }
+ }
+</script>
+</body>
+</html>
Modified: trunk/LayoutTests/platform/glib/TestExpectations (290857 => 290858)
--- trunk/LayoutTests/platform/glib/TestExpectations 2022-03-05 01:44:20 UTC (rev 290857)
+++ trunk/LayoutTests/platform/glib/TestExpectations 2022-03-05 02:03:49 UTC (rev 290858)
@@ -331,6 +331,8 @@
# Accessibility-related bugs
#////////////////////////////////////////////////////////////////////////////////////////
+accessibility/svg-font-face.html [ Skip ]
+
# Need to implement AccessibilityUIElement::hasDocumentRoleAncestor(), AccessibilityUIElement::hasWebApplicationAncestor(),
# AccessibilityUIElement::isInDescriptionListDetail(), AccessibilityUIElement::isInDescriptionListTerm(), and
# AccessibilityUIElement::isInCell().
Modified: trunk/LayoutTests/platform/ios/TestExpectations (290857 => 290858)
--- trunk/LayoutTests/platform/ios/TestExpectations 2022-03-05 01:44:20 UTC (rev 290857)
+++ trunk/LayoutTests/platform/ios/TestExpectations 2022-03-05 02:03:49 UTC (rev 290858)
@@ -2105,6 +2105,7 @@
accessibility/selected-state-changed-notifications.html [ Pass ]
accessibility/element-line-rects-and-text.html [ Pass ]
+accessibility/svg-font-face.html [ Pass ]
# Enable "attachment element" test for iOS
accessibility/attachment-element.html [ Pass ]
Modified: trunk/LayoutTests/platform/mac/accessibility/element-line-rects-and-text-expected.txt (290857 => 290858)
--- trunk/LayoutTests/platform/mac/accessibility/element-line-rects-and-text-expected.txt 2022-03-05 01:44:20 UTC (rev 290857)
+++ trunk/LayoutTests/platform/mac/accessibility/element-line-rects-and-text-expected.txt 2022-03-05 02:03:49 UTC (rev 290858)
@@ -10,28 +10,28 @@
On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
-text = "This is some testing content. {\n UIAccessibilityTokenFontFamily = Times;\n UIAccessibilityTokenFontName = \"Times Roman\";\n UIAccessibilityTokenFontSize = 16;\n}A link here.{\n UIAccessibilityTokenFontFamily = Times;\n UIAccessibilityTokenFontName = \"Times Roman\";\n UIAccessibilityTokenFontSize = 16;\n UIAccessibilityTokenUnderline = 1;\n} MOre text.{\n UIAccessibilityTokenFontFamily = Times;\n UIAccessibilityTokenFontName = \"Times Roman\";\n UIAccessibilityTokenFontSize = 16;\n}";
+text = "This is some testing content. {\n AXFont = {\n AXFontFamily = Times;\n AXFontName = \"Times-Roman\";\n AXFontSize = 16;\n AXVisibleName = \"Times Roman\";\n };\n}A link here.{\n AXFont = {\n AXFontFamily = Times;\n AXFontName = \"Times-Roman\";\n AXFontSize = 16;\n AXVisibleName = \"Times Roman\";\n };\n UIAccessibilityTokenUnderline = 1;\n} MOre text.{\n AXFont = {\n AXFontFamily = Times;\n AXFontName = \"Times-Roman\";\n AXFontSize = 16;\n AXVisibleName = \"Times Roman\";\n };\n}";
width > 0: true
height > 0: true
-text = "z{\n UIAccessibilityTokenFontFamily = Times;\n UIAccessibilityTokenFontName = \"Times Roman\";\n UIAccessibilityTokenFontSize = 16;\n}";
+text = "z{\n AXFont = {\n AXFontFamily = Times;\n AXFontName = \"Times-Roman\";\n AXFontSize = 16;\n AXVisibleName = \"Times Roman\";\n };\n}";
width > 0: true
height > 0: true
-text = "Another line of text.{\n UIAccessibilityTokenFontFamily = Times;\n UIAccessibilityTokenFontName = \"Times Roman\";\n UIAccessibilityTokenFontSize = 16;\n}";
+text = "Another line of text.{\n AXFont = {\n AXFontFamily = Times;\n AXFontName = \"Times-Roman\";\n AXFontSize = 16;\n AXVisibleName = \"Times Roman\";\n };\n}";
width > 0: true
height > 0: true
text = "cake{\n}";
width > 0: true
height > 0: true
-text = "Jack and Jill went up the hill to fetch a pail of water. Jack fell down...{\n UIAccessibilityTokenFontFamily = Times;\n UIAccessibilityTokenFontName = \"Times Roman\";\n UIAccessibilityTokenFontSize = 14;\n}";
+text = "Jack and Jill went up the hill to fetch a pail of water. Jack fell down...{\n AXFont = {\n AXFontFamily = Times;\n AXFontName = \"Times-Roman\";\n AXFontSize = 14;\n AXVisibleName = \"Times Roman\";\n };\n}";
width > 0: true
height > 0: true
-text = "abcdefghijklmnopqrstuvwxyz0123456789 abcdefghijklmnopqrstuvwxyz0123456789 {\n UIAccessibilityTokenFontFamily = Times;\n UIAccessibilityTokenFontName = \"Times Roman\";\n UIAccessibilityTokenFontSize = 16;\n}";
+text = "abcdefghijklmnopqrstuvwxyz0123456789 abcdefghijklmnopqrstuvwxyz0123456789 {\n AXFont = {\n AXFontFamily = Times;\n AXFontName = \"Times-Roman\";\n AXFontSize = 16;\n AXVisibleName = \"Times Roman\";\n };\n}";
width > 0: true
height > 0: true
-text = "abcdefghijklmnopqrstuvwxyz0123456789-abcdefghijklmnopqrstuvwxyz0123456789-{\n UIAccessibilityTokenFontFamily = Times;\n UIAccessibilityTokenFontName = \"Times Roman\";\n UIAccessibilityTokenFontSize = 16;\n}";
+text = "abcdefghijklmnopqrstuvwxyz0123456789-abcdefghijklmnopqrstuvwxyz0123456789-{\n AXFont = {\n AXFontFamily = Times;\n AXFontName = \"Times-Roman\";\n AXFontSize = 16;\n AXVisibleName = \"Times Roman\";\n };\n}";
width > 0: true
height > 0: true
-text = "abcdefghijklmnopqrstuvwxyz0123456789{\n UIAccessibilityTokenFontFamily = Times;\n UIAccessibilityTokenFontName = \"Times Roman\";\n UIAccessibilityTokenFontSize = 16;\n}";
+text = "abcdefghijklmnopqrstuvwxyz0123456789{\n AXFont = {\n AXFontFamily = Times;\n AXFontName = \"Times-Roman\";\n AXFontSize = 16;\n AXVisibleName = \"Times Roman\";\n };\n}";
width > 0: true
height > 0: true
PASS successfullyParsed is true
Modified: trunk/LayoutTests/platform/win/TestExpectations (290857 => 290858)
--- trunk/LayoutTests/platform/win/TestExpectations 2022-03-05 01:44:20 UTC (rev 290857)
+++ trunk/LayoutTests/platform/win/TestExpectations 2022-03-05 02:03:49 UTC (rev 290858)
@@ -4922,7 +4922,10 @@
accessibility/selected-state-changed-notifications.html [ Skip ]
accessibility/element-line-rects-and-text.html [ Skip ]
accessibility/dialog-properties.html [ Skip ]
+
+# Missing AccessibilityUIElement::attributedStringForRange implementation
accessibility/native-text-control-attributed-string.html [ Skip ]
+accessibility/svg-font-face.html [ Skip ]
webkit.org/b/229247 http/tests/fetch/keepalive-fetch-2.html [ Pass Failure ]
Modified: trunk/Source/WebCore/ChangeLog (290857 => 290858)
--- trunk/Source/WebCore/ChangeLog 2022-03-05 01:44:20 UTC (rev 290857)
+++ trunk/Source/WebCore/ChangeLog 2022-03-05 02:03:49 UTC (rev 290858)
@@ -1,3 +1,43 @@
+2022-03-04 Tyler Wilcock <[email protected]>
+
+ AX: [WebAccessibilityObjectWrapperMac AXAttributeStringSetFont] crashes when given a font with a nil postscript name, font family, or display name
+ https://bugs.webkit.org/show_bug.cgi?id=237373
+
+ Reviewed by Chris Fleizach and Andres Gonzalez.
+
+ [WebAccessibilityObjectWrapperMac AXAttributeStringSetFont] crashes when given a font with a
+ nil postscript name, font family, or display name. This can be
+ triggered with a custom SVG @font-face -- for example:
+
+ @font-face {
+ font-family: 'Litherum';
+ src: url("resources/Litherum.svg") format(svg);
+ }
+ * { font-family: 'Litherum'; }
+
+ We fix this by checking if these values are nil before trying to add
+ them to a dictionary.
+
+ This patch also centralizes application of fonts to attributed strings
+ by moving AXAttributeStringSetFont to the base wrapper. In doing so,
+ we fix a bug where if [WebAccessibilityObjectWrapperBase AXAttributeStringSetStyle] was
+ called from a Mac-context, it set iOS font properties (e.g.
+ UIAccessibilityTokenFontFamily instead of NSAccessibilityFontFamilyKey).
+
+ Test: accessibility/svg-font-face.html
+
+ * accessibility/mac/WebAccessibilityObjectWrapperBase.h:
+ * accessibility/mac/WebAccessibilityObjectWrapperBase.mm:
+ (AXAttributedStringRangeIsValid): Added.
+ (AXAttributedStringSetFont): Added.
+ * accessibility/mac/WebAccessibilityObjectWrapperMac.mm:
+ (AXAttributeStringSetStyle):
+ (AXAttributedStringAppendText):
+ (AXAttributedStringRangeIsValid):
+ Moved to base wrapper.
+ (AXAttributeStringSetFont):
+ Moved to base wrapper.
+
2022-03-04 Patrick Angle <[email protected]>
REGRESSION (r284472): [ Monterey ] http/tests/websocket/tests/hybi/inspector/send-and-recieve-debugger.html is failing
Modified: trunk/Source/WebCore/accessibility/mac/WebAccessibilityObjectWrapperBase.h (290857 => 290858)
--- trunk/Source/WebCore/accessibility/mac/WebAccessibilityObjectWrapperBase.h 2022-03-05 01:44:20 UTC (rev 290857)
+++ trunk/Source/WebCore/accessibility/mac/WebAccessibilityObjectWrapperBase.h 2022-03-05 02:03:49 UTC (rev 290858)
@@ -27,6 +27,7 @@
*/
#import "AccessibilityObjectInterface.h"
+#import "FontPlatformData.h"
#import <CoreGraphics/CoreGraphics.h>
#import <variant>
#import <wtf/RefPtr.h>
@@ -57,6 +58,9 @@
static NSString * const UIAccessibilityTextAttributeContext = @"UIAccessibilityTextAttributeContext";
static NSString * const UIAccessibilityTextualContextSourceCode = @"UIAccessibilityTextualContextSourceCode";
+bool AXAttributedStringRangeIsValid(NSAttributedString *, const NSRange&);
+void AXAttributedStringSetFont(NSMutableAttributedString *, CTFontRef, const NSRange&);
+
@interface WebAccessibilityObjectWrapperBase : NSObject {
WebCore::AXCoreObject* m_axObject;
#if ENABLE(ACCESSIBILITY_ISOLATED_TREE)
Modified: trunk/Source/WebCore/accessibility/mac/WebAccessibilityObjectWrapperBase.mm (290857 => 290858)
--- trunk/Source/WebCore/accessibility/mac/WebAccessibilityObjectWrapperBase.mm 2022-03-05 01:44:20 UTC (rev 290857)
+++ trunk/Source/WebCore/accessibility/mac/WebAccessibilityObjectWrapperBase.mm 2022-03-05 02:03:49 UTC (rev 290858)
@@ -46,8 +46,6 @@
#import "ColorMac.h"
#import "ContextMenuController.h"
#import "Editing.h"
-#import "Font.h"
-#import "FontCascade.h"
#import "FrameSelection.h"
#import "HTMLNames.h"
#import "LayoutRect.h"
@@ -578,27 +576,59 @@
[attrString removeAttribute:UIAccessibilityTokenHeadingLevel range:range];
}
-static void AXAttributeStringSetFont(NSMutableAttributedString* attrString, CTFontRef font, NSRange range)
+// When modifying attributed strings, the range can come from a source which may provide faulty information (e.g. the spell checker).
+// To protect against such cases, the range should be validated before adding or removing attributes.
+bool AXAttributedStringRangeIsValid(NSAttributedString *attributedString, const NSRange& range)
{
- if (!font)
+ return NSMaxRange(range) <= [attributedString length];
+}
+
+void AXAttributedStringSetFont(NSMutableAttributedString *attributedString, CTFontRef font, const NSRange& range)
+{
+ if (!AXAttributedStringRangeIsValid(attributedString, range))
return;
- RetainPtr<CFStringRef> fullName = adoptCF(CTFontCopyFullName(font));
- RetainPtr<CFStringRef> familyName = adoptCF(CTFontCopyFamilyName(font));
+ if (!font) {
+#if PLATFORM(MAC)
+ [attributedString removeAttribute:NSAccessibilityFontTextAttribute range:range];
+#endif
+ return;
+ }
- NSNumber* size = [NSNumber numberWithFloat:CTFontGetSize(font)];
- CTFontSymbolicTraits traits = CTFontGetSymbolicTraits(font);
- NSNumber* bold = [NSNumber numberWithBool:(traits & kCTFontTraitBold)];
+ auto fontAttributes = adoptNS([[NSMutableDictionary alloc] init]);
+ auto familyName = adoptCF(CTFontCopyFamilyName(font));
+ NSNumber *size = [NSNumber numberWithFloat:CTFontGetSize(font)];
+#if PLATFORM(IOS_FAMILY)
+ auto fullName = adoptCF(CTFontCopyFullName(font));
if (fullName)
- [attrString addAttribute:UIAccessibilityTokenFontName value:(NSString*)fullName.get() range:range];
+ [fontAttributes setValue:bridge_cast(fullName.get()) forKey:UIAccessibilityTokenFontName];
if (familyName)
- [attrString addAttribute:UIAccessibilityTokenFontFamily value:(NSString*)familyName.get() range:range];
+ [fontAttributes setValue:bridge_cast(familyName.get()) forKey:UIAccessibilityTokenFontFamily];
if ([size boolValue])
- [attrString addAttribute:UIAccessibilityTokenFontSize value:size range:range];
- if ([bold boolValue] || (traits & kCTFontTraitBold))
- [attrString addAttribute:UIAccessibilityTokenBold value:@YES range:range];
+ [fontAttributes setValue:size forKey:UIAccessibilityTokenFontSize];
+ auto traits = CTFontGetSymbolicTraits(font);
+ if (traits & kCTFontTraitBold)
+ [fontAttributes setValue:@YES forKey:UIAccessibilityTokenBold];
if (traits & kCTFontTraitItalic)
- [attrString addAttribute:UIAccessibilityTokenItalic value:@YES range:range];
+ [fontAttributes setValue:@YES forKey:UIAccessibilityTokenItalic];
+
+ [attributedString addAttributes:fontAttributes.get() range:range];
+#endif
+
+#if PLATFORM(MAC)
+ [fontAttributes setValue:size forKey:NSAccessibilityFontSizeKey];
+
+ if (familyName)
+ [fontAttributes setValue:bridge_cast(familyName.get()) forKey:NSAccessibilityFontFamilyKey];
+ auto postScriptName = adoptCF(CTFontCopyPostScriptName(font));
+ if (postScriptName)
+ [fontAttributes setValue:bridge_cast(postScriptName.get()) forKey:NSAccessibilityFontNameKey];
+ auto displayName = adoptCF(CTFontCopyDisplayName(font));
+ if (displayName)
+ [fontAttributes setValue:bridge_cast(displayName.get()) forKey:NSAccessibilityVisibleNameKey];
+
+ [attributedString addAttribute:NSAccessibilityFontTextAttribute value:fontAttributes.get() range:range];
+#endif
}
static void AXAttributeStringSetNumber(NSMutableAttributedString* attrString, NSString* attribute, NSNumber* number, NSRange range)
@@ -614,7 +644,7 @@
auto& style = renderer->style();
// set basic font info
- AXAttributeStringSetFont(attrString, style.fontCascade().primaryFont().getCTFont(), range);
+ AXAttributedStringSetFont(attrString, style.fontCascade().primaryFont().getCTFont(), range);
auto decor = style.textDecorationsInEffect();
if (decor & TextDecorationLine::Underline)
Modified: trunk/Source/WebCore/accessibility/mac/WebAccessibilityObjectWrapperMac.mm (290857 => 290858)
--- trunk/Source/WebCore/accessibility/mac/WebAccessibilityObjectWrapperMac.mm 2022-03-05 01:44:20 UTC (rev 290857)
+++ trunk/Source/WebCore/accessibility/mac/WebAccessibilityObjectWrapperMac.mm 2022-03-05 02:03:49 UTC (rev 290858)
@@ -768,31 +768,6 @@
return adoptCF(AXTextMarkerCreate(kCFAllocatorDefault, (const UInt8*)&textMarkerData.value(), sizeof(textMarkerData.value())));
}
-// When modifying attributed strings, the range can come from a source which may provide faulty information (e.g. the spell checker).
-// To protect against such cases the range should be validated before adding or removing attributes.
-static BOOL AXAttributedStringRangeIsValid(NSAttributedString *attrString, NSRange range)
-{
- return (range.location < [attrString length] && NSMaxRange(range) <= [attrString length]);
-}
-
-static void AXAttributeStringSetFont(NSMutableAttributedString *attrString, NSString *attribute, CTFontRef font, NSRange range)
-{
- if (!AXAttributedStringRangeIsValid(attrString, range))
- return;
-
- if (font) {
- NSDictionary *dictionary = @{
- NSAccessibilityFontNameKey: (__bridge NSString *)adoptCF(CTFontCopyPostScriptName(font)).get(),
- NSAccessibilityFontFamilyKey: (__bridge NSString *)adoptCF(CTFontCopyFamilyName(font)).get(),
- NSAccessibilityVisibleNameKey: (__bridge NSString *)adoptCF(CTFontCopyDisplayName(font)).get(),
- NSAccessibilityFontSizeKey: @(CTFontGetSize(font)),
- };
- [attrString addAttribute:attribute value:dictionary range:range];
- } else
- [attrString removeAttribute:attribute range:range];
-
-}
-
static void AXAttributeStringSetColor(NSMutableAttributedString* attrString, NSString* attribute, NSColor* color, NSRange range)
{
if (!AXAttributedStringRangeIsValid(attrString, range))
@@ -821,10 +796,10 @@
static void AXAttributeStringSetStyle(NSMutableAttributedString* attrString, RenderObject* renderer, NSRange range)
{
const RenderStyle& style = renderer->style();
-
+
// set basic font info
- AXAttributeStringSetFont(attrString, NSAccessibilityFontTextAttribute, style.fontCascade().primaryFont().getCTFont(), range);
-
+ AXAttributedStringSetFont(attrString, style.fontCascade().primaryFont().getCTFont(), range);
+
// set basic colors
AXAttributeStringSetColor(attrString, NSAccessibilityForegroundColorTextAttribute, cocoaColor(style.visitedDependentColor(CSSPropertyColor)).get(), range);
AXAttributeStringSetColor(attrString, NSAccessibilityBackgroundColorTextAttribute, cocoaColor(style.visitedDependentColor(CSSPropertyBackgroundColor)).get(), range);
@@ -1023,7 +998,7 @@
#endif
[attrString removeAttribute:NSAccessibilityMisspelledTextAttribute range:attrStringRange];
}
-
+
// set new attributes
AXAttributeStringSetStyle(attrString, renderer, attrStringRange);
AXAttributeStringSetHeadingLevel(attrString, renderer, attrStringRange);
