Title: [118965] branches/chromium/1132
- Revision
- 118965
- Author
- [email protected]
- Date
- 2012-05-30 14:01:25 -0700 (Wed, 30 May 2012)
Log Message
Merge 117976 - Chromium AX: Crash when menulist adds selected option via document.write
https://bugs.webkit.org/show_bug.cgi?id=87028
Reviewed by Chris Fleizach.
Source/WebCore:
Test: platform/chromium/accessibility/add-to-menu-list-crashes.html
* rendering/RenderMenuList.cpp:
(WebCore::RenderMenuList::addChild):
LayoutTests:
* platform/chromium/accessibility/add-to-menu-list-crashes-expected.txt: Added.
* platform/chromium/accessibility/add-to-menu-list-crashes.html: Added.
[email protected]
Review URL: https://chromiumcodereview.appspot.com/10446087
Modified Paths
Added Paths
Diff
Copied: branches/chromium/1132/LayoutTests/platform/chromium/accessibility/add-to-menu-list-crashes-expected.txt (from rev 117976, trunk/LayoutTests/platform/chromium/accessibility/add-to-menu-list-crashes-expected.txt) (0 => 118965)
--- branches/chromium/1132/LayoutTests/platform/chromium/accessibility/add-to-menu-list-crashes-expected.txt (rev 0)
+++ branches/chromium/1132/LayoutTests/platform/chromium/accessibility/add-to-menu-list-crashes-expected.txt 2012-05-30 21:01:25 UTC (rev 118965)
@@ -0,0 +1,9 @@
+This test makes sure that adding a selected option to a menu list via an unusual route (document.write from an external script) doesn't trigger a crash when didUpdateActiveOption is called before the children are updated.
+
+PASS accessiblePopup.childrenCount is 1
+PASS accessiblePopup.childrenCount is 2
+PASS accessiblePopup.childrenCount is 1
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
Copied: branches/chromium/1132/LayoutTests/platform/chromium/accessibility/add-to-menu-list-crashes.html (from rev 117976, trunk/LayoutTests/platform/chromium/accessibility/add-to-menu-list-crashes.html) (0 => 118965)
--- branches/chromium/1132/LayoutTests/platform/chromium/accessibility/add-to-menu-list-crashes.html (rev 0)
+++ branches/chromium/1132/LayoutTests/platform/chromium/accessibility/add-to-menu-list-crashes.html 2012-05-30 21:01:25 UTC (rev 118965)
@@ -0,0 +1,41 @@
+<html>
+<head>
+<script src=""
+</head>
+<body>
+
+<script>
+ if (window.layoutTestController)
+ layoutTestController.dumpAsText();
+</script>
+
+<p id="description">This test makes sure that adding a selected option to a menu list via an unusual route (document.write from an external script) doesn't trigger a crash when didUpdateActiveOption is called before the children are updated.</p>
+<div id="console"></div>
+
+<select id="menulist">
+ <option>1</option>
+ <script>
+ window.menulist = document.getElementById("menulist");
+ menulist.focus();
+ if (window.layoutTestController && window.accessibilityController) {
+ window.accessibleMenulist = accessibilityController.focusedElement;
+ window.accessiblePopup = accessibleMenulist.childAtIndex(0);
+ shouldBe("accessiblePopup.childrenCount", "1");
+ }
+ </script>
+ <script src="" selected>2');"></script>
+ <script>
+ if (window.layoutTestController && window.accessibilityController)
+ shouldBe("accessiblePopup.childrenCount", "2");
+ </script>
+ <script>
+ menulist.removeChild(menulist.selectedOptions[0]);
+ if (window.layoutTestController && window.accessibilityController)
+ shouldBe("accessiblePopup.childrenCount", "1");
+ </script>
+</select>
+
+<script src=""
+
+</body>
+</html>
Modified: branches/chromium/1132/Source/WebCore/rendering/RenderMenuList.cpp (118964 => 118965)
--- branches/chromium/1132/Source/WebCore/rendering/RenderMenuList.cpp 2012-05-30 20:52:58 UTC (rev 118964)
+++ branches/chromium/1132/Source/WebCore/rendering/RenderMenuList.cpp 2012-05-30 21:01:25 UTC (rev 118965)
@@ -119,6 +119,9 @@
createInnerBlock();
m_innerBlock->addChild(newChild, beforeChild);
ASSERT(m_innerBlock == firstChild());
+
+ if (AXObjectCache::accessibilityEnabled())
+ document()->axObjectCache()->childrenChanged(this);
}
void RenderMenuList::removeChild(RenderObject* oldChild)
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo.cgi/webkit-changes
