Title: [118478] trunk
- Revision
- 118478
- Author
- [email protected]
- Date
- 2012-05-24 22:56:43 -0700 (Thu, 24 May 2012)
Log Message
Crash in WebCore::AccessibilityTable::isDataTable
https://bugs.webkit.org/show_bug.cgi?id=87409
Reviewed by Abhishek Arya.
Source/WebCore:
Use Node::rendererIsEditable everywhere rather than
Node::isContentEditable because the latter can trigger a layout
and destroy the renderer. New test covers the change to
AccessibilityTable.cpp, changes to AccessibilityRenderObject.cpp
are covered by existing tests.
Test: accessibility/contenteditable-table-check-causes-crash.html
* accessibility/AccessibilityRenderObject.cpp:
(WebCore::AccessibilityRenderObject::isReadOnly):
(WebCore::AccessibilityRenderObject::contentChanged):
* accessibility/AccessibilityTable.cpp:
(WebCore::AccessibilityTable::isDataTable):
LayoutTests:
* accessibility/contenteditable-table-check-causes-crash-expected.txt: Added.
* accessibility/contenteditable-table-check-causes-crash.html: Added.
Modified Paths
Added Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (118477 => 118478)
--- trunk/LayoutTests/ChangeLog 2012-05-25 05:46:54 UTC (rev 118477)
+++ trunk/LayoutTests/ChangeLog 2012-05-25 05:56:43 UTC (rev 118478)
@@ -1,3 +1,13 @@
+2012-05-24 Dominic Mazzoni <[email protected]>
+
+ Crash in WebCore::AccessibilityTable::isDataTable
+ https://bugs.webkit.org/show_bug.cgi?id=87409
+
+ Reviewed by Abhishek Arya.
+
+ * accessibility/contenteditable-table-check-causes-crash-expected.txt: Added.
+ * accessibility/contenteditable-table-check-causes-crash.html: Added.
+
2012-05-24 Filip Pizlo <[email protected]>
REGRESSION (r118013-r118031): Loops/Reloads under www.yahoo.com, quits after three tries with error
Added: trunk/LayoutTests/accessibility/contenteditable-table-check-causes-crash-expected.txt (0 => 118478)
--- trunk/LayoutTests/accessibility/contenteditable-table-check-causes-crash-expected.txt (rev 0)
+++ trunk/LayoutTests/accessibility/contenteditable-table-check-causes-crash-expected.txt 2012-05-25 05:56:43 UTC (rev 118478)
@@ -0,0 +1,9 @@
+Ensures that this snippet does not lead to a crash in the code that detects if a table is contenteditable. Bug 87409.
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
Added: trunk/LayoutTests/accessibility/contenteditable-table-check-causes-crash.html (0 => 118478)
--- trunk/LayoutTests/accessibility/contenteditable-table-check-causes-crash.html (rev 0)
+++ trunk/LayoutTests/accessibility/contenteditable-table-check-causes-crash.html 2012-05-25 05:56:43 UTC (rev 118478)
@@ -0,0 +1,29 @@
+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<script src=""
+</head>
+<body>
+
+<script>
+ description("Ensures that this snippet does not lead to a crash in the code that detects if a table is contenteditable. Bug 87409.");
+</script>
+
+<style>
+.tableStyle { display: inline-table; content: counter(section);</style>
+<script>
+function crash() {
+ var node = document.createElement('keygen');
+ node.setAttribute('autofocus', 'autofocus');
+ node.setAttribute('class', 'tableStyle');
+ document.documentElement.appendChild(node);
+}
+window._onload_ = crash;
+</script>
+
+<p id="description"></p>
+<div id="console"></div>
+
+<script src=""
+</body>
+</html>
Modified: trunk/Source/WebCore/ChangeLog (118477 => 118478)
--- trunk/Source/WebCore/ChangeLog 2012-05-25 05:46:54 UTC (rev 118477)
+++ trunk/Source/WebCore/ChangeLog 2012-05-25 05:56:43 UTC (rev 118478)
@@ -1,3 +1,24 @@
+2012-05-24 Dominic Mazzoni <[email protected]>
+
+ Crash in WebCore::AccessibilityTable::isDataTable
+ https://bugs.webkit.org/show_bug.cgi?id=87409
+
+ Reviewed by Abhishek Arya.
+
+ Use Node::rendererIsEditable everywhere rather than
+ Node::isContentEditable because the latter can trigger a layout
+ and destroy the renderer. New test covers the change to
+ AccessibilityTable.cpp, changes to AccessibilityRenderObject.cpp
+ are covered by existing tests.
+
+ Test: accessibility/contenteditable-table-check-causes-crash.html
+
+ * accessibility/AccessibilityRenderObject.cpp:
+ (WebCore::AccessibilityRenderObject::isReadOnly):
+ (WebCore::AccessibilityRenderObject::contentChanged):
+ * accessibility/AccessibilityTable.cpp:
+ (WebCore::AccessibilityTable::isDataTable):
+
2012-05-24 Yoshifumi Inoue <[email protected]>
[Forms][TextArea] Too long validation message doesn't count LF as CRLF
Modified: trunk/Source/WebCore/accessibility/AccessibilityRenderObject.cpp (118477 => 118478)
--- trunk/Source/WebCore/accessibility/AccessibilityRenderObject.cpp 2012-05-25 05:46:54 UTC (rev 118477)
+++ trunk/Source/WebCore/accessibility/AccessibilityRenderObject.cpp 2012-05-25 05:56:43 UTC (rev 118478)
@@ -717,7 +717,7 @@
return true;
HTMLElement* body = document->body();
- if (body && body->isContentEditable())
+ if (body && body->rendererIsEditable())
return false;
return !document->rendererIsEditable();
@@ -3428,14 +3428,8 @@
if (parent->supportsARIALiveRegion())
cache->postNotification(renderParent, AXObjectCache::AXLiveRegionChanged, true);
- if (parent->isARIATextControl() && !parent->isNativeTextControl() && !parent->node()->isContentEditable()) {
- // isContentEditable() might trigger a layout update and invalidate the parent.
- ASSERT(!parent->renderer() || parent->renderer() == renderParent);
- if (parent->isDetached())
- break;
-
+ if (parent->isARIATextControl() && !parent->isNativeTextControl() && !parent->node()->rendererIsEditable())
cache->postNotification(renderParent, AXObjectCache::AXValueChanged, true);
- }
}
}
Modified: trunk/Source/WebCore/accessibility/AccessibilityTable.cpp (118477 => 118478)
--- trunk/Source/WebCore/accessibility/AccessibilityTable.cpp 2012-05-25 05:46:54 UTC (rev 118477)
+++ trunk/Source/WebCore/accessibility/AccessibilityTable.cpp 2012-05-25 05:56:43 UTC (rev 118478)
@@ -99,7 +99,7 @@
// When a section of the document is contentEditable, all tables should be
// treated as data tables, otherwise users may not be able to work with rich
// text editors that allow creating and editing tables.
- if (node() && node()->isContentEditable())
+ if (node() && node()->rendererIsEditable())
return true;
// This employs a heuristic to determine if this table should appear.
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo.cgi/webkit-changes
